CVE-2026-74043: Wazuh Path Traversal Vulnerability

CVE-2026-74043 Overview

CVE-2026-74043 is a path traversal vulnerability [CWE-22] affecting Wazuh versions from 4.1.1 before 4.14.8. The flaw resides in the upload_list_file, upload_rule_file, and upload_decoder_file functions used by the Wazuh cluster. Malicious cluster workers can submit DistributedAPI requests containing ../ sequences in the filename parameter. These sequences bypass REST controller validation and allow attackers to write files to arbitrary paths on the manager as the wazuh user. Exploitation requires possession of the cluster key, limiting the attacker set to insiders or adversaries who have already compromised a cluster node.

Critical Impact
Attackers holding the cluster key can write arbitrary files as the wazuh user on the Wazuh manager, enabling tampering with rules, decoders, and lists that drive detection logic.

Affected Products

Wazuh 4.1.1 through 4.14.7
Wazuh cluster manager components exposing DistributedAPI
Fixed in Wazuh 4.14.8

Discovery Timeline

2026-10-13 - CVE-2026-74043 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-74043

Vulnerability Analysis

Wazuh is an open-source security monitoring platform that operates in a clustered architecture, where worker nodes synchronize configuration artifacts with a master node through the DistributedAPI. The upload handlers upload_list_file, upload_rule_file, and upload_decoder_file accept a filename argument from cluster peers to persist CDB lists, detection rules, and decoder definitions. The REST controller performs validation on the externally facing side, but the DistributedAPI path handles filenames supplied by cluster workers without equivalent sanitization. Any content written through these functions executes under the identity of the wazuh service user, which owns the ruleset directories that drive detection outcomes.

Root Cause

The root cause is improper neutralization of path traversal sequences in filename parameters received over the internal cluster channel. Validation that normally rejects ../ sequences in REST requests is not consistently applied when the same payloads arrive via DistributedAPI from a cluster worker. As a result, the server resolves the attacker-controlled relative path against trusted base directories and writes outside the intended ruleset locations.

Attack Vector

Exploitation requires network access to the cluster communication channel and knowledge of the cluster key. An authenticated worker crafts a DistributedAPI request to one of the three upload functions with a filename such as ../../etc/cron.d/payload. The master processes the request and writes attacker-controlled content to the chosen path. Because files are written as the wazuh user, attackers can overwrite rule and decoder files, poison detection logic, or stage files in locations consumed by downstream processes to escalate impact.

No verified public proof-of-concept code is available. Technical specifics are documented in the Wazuh Security Advisory GHSA-cw26-jj8q-x7w5 and the VulnCheck Advisory: Wazuh Path Traversal.

Detection Methods for CVE-2026-74043

Indicators of Compromise

DistributedAPI requests to upload_list_file, upload_rule_file, or upload_decoder_file where the filename field contains ../, encoded traversal sequences, or absolute paths.
Unexpected file creation or modification outside /var/ossec/etc/lists/, /var/ossec/etc/rules/, and /var/ossec/etc/decoders/ performed by the wazuh user.
Modification timestamps on detection rules, decoders, or CDB lists that do not align with change-management records.

Detection Strategies

Audit Wazuh manager logs for DistributedAPI calls carrying traversal patterns in filename arguments and correlate them with the originating cluster worker.
Monitor filesystem telemetry for writes performed by the wazuh user that land outside the expected ruleset directories.
Compare rule, decoder, and list files on disk against a known-good baseline from version control to surface silent tampering.

Monitoring Recommendations

Forward Wazuh manager and cluster logs to a centralized analytics platform and alert on upload calls that include .., %2e%2e, or absolute path prefixes.
Track changes to /var/ossec/etc/ with file integrity monitoring and generate alerts on unexpected additions or modifications.
Watch for new or anomalous cluster worker nodes joining the cluster and for authentication events using the cluster key from unfamiliar sources.

How to Mitigate CVE-2026-74043

Immediate Actions Required

Upgrade all Wazuh manager and worker nodes to version 4.14.8 or later as described in the Wazuh 4.14.8 release notes.
Rotate the cluster key and any credentials that may have been exposed to systems within trust of the cluster.
Review ruleset, decoder, and CDB list files against trusted sources and revert unauthorized changes.

Patch Information

The vulnerability is fixed in Wazuh 4.14.8. The patch adds consistent validation of the filename parameter in the DistributedAPI upload handlers so that path traversal sequences are rejected before the manager writes files to disk. Deployment details are published in the Wazuh Security Advisory GHSA-cw26-jj8q-x7w5.

Workarounds

Restrict network reachability of the cluster communication port so only trusted manager and worker nodes can connect.
Enforce strict access control on the cluster key file and store it with least-privilege permissions on each node.
Deploy file integrity monitoring on Wazuh ruleset and configuration directories to detect unauthorized writes until the upgrade is complete.

bash

# Verify installed Wazuh version and upgrade to the patched release
/var/ossec/bin/wazuh-control info | grep WAZUH_VERSION

# Debian/Ubuntu
apt-get update && apt-get install --only-upgrade wazuh-manager=4.14.8-1

# RHEL/CentOS
yum update wazuh-manager-4.14.8-1

# Confirm the upgrade
/var/ossec/bin/wazuh-control info | grep WAZUH_VERSION