CVE-2026-74044: Wazuh Path Traversal Vulnerability

CVE-2026-74044 Overview

CVE-2026-74044 is a path traversal vulnerability [CWE-22] in Wazuh versions 4.0.0 through 4.14.5. The flaw resides in the cluster hello handshake, where the master node fails to validate the node name field supplied by a connecting peer. An authenticated peer holding a valid cluster Fernet key can submit a traversal-shaped node name and disconnect, triggering the master's peer cleanup routine. That routine then removes the contents of arbitrary directories within the Wazuh installation path that are writable by the wazuh user.

Critical Impact
Authenticated cluster peers can delete arbitrary directory contents inside the Wazuh installation path, corrupting the SIEM's own runtime state and rules.

Affected Products

Wazuh 4.0.0 through 4.14.5
Wazuh cluster master nodes running vulnerable releases
Fixed in Wazuh 4.14.6

Discovery Timeline

2026-08-18 - CVE-2026-74044 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-74044

Vulnerability Analysis

Wazuh clusters use an encrypted hello handshake between peers to establish trust. Each connecting worker sends a payload containing its node name, and the master indexes peer state under a directory derived from that name. The master routine that cleans up disconnected peers concatenates the attacker-controlled node name into a filesystem path without normalization or containment checks.

A peer that authenticates with a valid Fernet key can supply a node name containing ../ sequences. When the peer disconnects, the master resolves the crafted path outside the intended cluster state directory and recursively deletes its contents. Any directory writable by the wazuh service account under the installation root is reachable, including rules, decoders, agent queues, and internal databases.

Root Cause

The root cause is missing input validation on the cluster hello node name field [CWE-22]. The master trusts the string as a safe directory component and passes it to filesystem operations without stripping traversal sequences or verifying that the resolved path remains inside the expected cluster state directory.

Attack Vector

Exploitation requires network reachability to the cluster port and possession of a valid Fernet key. The attacker connects as a peer, completes the encrypted handshake, sets the node name to a traversal string such as ../../etc/rules, and terminates the connection. The master's cleanup handler then deletes the contents of the resolved directory. See the GitHub Security Advisory and the VulnCheck Advisory for technical detail.

Detection Methods for CVE-2026-74044

Indicators of Compromise

Unexpected disappearance of files in /var/ossec/etc/, /var/ossec/queue/, or other subdirectories writable by the wazuh user.
Cluster log entries showing peer registrations with node names containing .., /, or unusual characters.
Master node restart loops or rule engine failures following a brief peer connection.

Detection Strategies

Inspect cluster.log on master nodes for hello messages with anomalous node_name values, especially strings containing path separators.
Enable filesystem auditing (auditd) on the Wazuh installation directory to record deletions performed by the wazuh user process.
Correlate short-lived peer connections with subsequent bulk file removal events on the master.

Monitoring Recommendations

Alert on cluster hello events originating from IPs outside the approved worker node inventory.
Track file-count baselines for etc/, queue/, and var/ subdirectories under the Wazuh install root and alert on sudden drops.
Monitor for unauthorized access to or exfiltration of the cluster Fernet key stored in ossec.conf.

How to Mitigate CVE-2026-74044

Immediate Actions Required

Upgrade all Wazuh cluster nodes to version 4.14.6 or later.
Rotate the cluster Fernet key if there is any suspicion of prior exposure.
Restrict the cluster port to the internal network segment shared by trusted worker nodes only.

Patch Information

The fix is delivered in Wazuh 4.14.6 via Pull Request #36460, which adds validation of the node name supplied in the cluster hello payload and prevents path traversal during peer cleanup. Details are published in the Wazuh Security Advisory GHSA-f34r-fcjf-qx6j.

Workarounds

Firewall the cluster port so only known worker IPs can complete the handshake.
Enforce strict filesystem permissions so the wazuh user cannot write outside required directories.
Store the cluster Fernet key in a secrets manager and audit every host that holds a copy.

bash

# Restrict Wazuh cluster port (default 1516) to trusted worker subnet
iptables -A INPUT -p tcp --dport 1516 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1516 -j DROP

# Verify installed Wazuh version is patched
/var/ossec/bin/wazuh-control info | grep WAZUH_VERSION