CVE-2026-93347: Wazuh Path Traversal Vulnerability

CVE-2026-93347 Overview

CVE-2026-93347 is a path traversal vulnerability [CWE-22] in Wazuh versions from 4.1.1 before 4.14.8. The flaw resides in the get_list_file helper used by the cluster DistributedAPI. Malicious cluster workers can supply unvalidated filename values containing directory traversal sequences. This lets attackers read arbitrary files that the wazuh user can access, including client.keys and ossec.conf with the embedded cluster key.

Exploitation requires the attacker to hold the cluster key, so this is a post-authentication issue scoped to compromised or rogue cluster workers.

Critical Impact
Attackers with cluster key access can read sensitive Wazuh configuration and credential files, enabling further compromise of the Wazuh manager and connected agents.

Affected Products

Wazuh 4.1.1 through 4.14.7
Wazuh manager cluster deployments using the DistributedAPI
Fixed in Wazuh 4.14.8

Discovery Timeline

2026-10-13 - CVE-2026-93347 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-93347

Vulnerability Analysis

The vulnerability exists in the get_list_file helper function within the Wazuh cluster DistributedAPI. The function accepts a filename parameter from cluster worker requests and uses it to resolve a file path on the manager. Because the filename value is not validated or canonicalized, an attacker can supply traversal sequences such as ../../../etc/... to escape the intended directory.

The DistributedAPI then returns the file contents to the requesting worker. Any file readable by the wazuh runtime user becomes accessible. Sensitive targets include client.keys, which contains agent registration credentials, and ossec.conf, which embeds the cluster key used to authenticate cluster peers.

Reading the cluster key enables an attacker to pivot further into the cluster trust boundary, elevating a single compromised worker into broader cluster control.

Root Cause

The root cause is missing input validation on filename parameters passed into get_list_file. The helper does not restrict the resolved path to an allowlisted directory, nor does it reject traversal sequences before performing file I/O. This is a classic path traversal defect [CWE-22] inside an inter-service API that assumed its callers were trusted peers.

Attack Vector

An attacker must first hold the Wazuh cluster key to authenticate as a cluster worker. From that position, the attacker crafts a DistributedAPI request to the master node containing a get_list_file call with a traversal-laden filename. The master processes the request, reads the targeted file, and returns its contents to the worker. See the GitHub Security Advisory GHSA-xrjw-cqrv-j92g and the VulnCheck Advisory Wazuh Path Traversal for technical details.

Detection Methods for CVE-2026-93347

Indicators of Compromise

DistributedAPI requests invoking get_list_file with filename values containing ../, ..\, or URL-encoded traversal sequences such as %2e%2e%2f.
Unexpected reads of client.keys, ossec.conf, or other files outside the cluster lists directory by the wazuh process.
Cluster worker nodes initiating list file requests for paths that do not match legitimate CDB list filenames.

Detection Strategies

Inspect Wazuh cluster logs under logs/cluster.log for get_list_file entries with abnormal filename arguments.
Alert on filesystem access by the wazuh user to paths outside expected cluster list directories.
Correlate cluster worker authentication events with subsequent anomalous DistributedAPI calls to identify compromised peers.

Monitoring Recommendations

Enable verbose cluster debug logging during triage to capture full DistributedAPI request parameters.
Monitor integrity of client.keys and ossec.conf and alert on reads from non-standard process contexts.
Track outbound traffic from Wazuh workers for signs of exfiltration following successful file reads.

How to Mitigate CVE-2026-93347

Immediate Actions Required

Upgrade all Wazuh manager and worker nodes to version 4.14.8 or later.
Rotate the cluster key defined in ossec.conf after upgrading, assuming prior exposure.
Rotate client.keys entries for agents whose credentials may have been read.
Audit cluster worker nodes for unauthorized access or compromise prior to the upgrade.

Patch Information

Wazuh released version 4.14.8 with the fix. See the GitHub Wazuh Release v4.14.8 notes and the GitHub Security Advisory GHSA-xrjw-cqrv-j92g for the full remediation details. The fix validates and canonicalizes filename inputs to the get_list_file helper before resolving the path.

Workarounds

Restrict network reachability of the cluster port (default 1516/tcp) to known manager and worker IP addresses only.
Store the cluster key with the minimum necessary filesystem permissions and audit access.
Isolate cluster worker hosts behind segmented networks to limit the blast radius of a compromised node.

bash

# Verify installed Wazuh manager version and upgrade
/var/ossec/bin/wazuh-control info | grep WAZUH_VERSION

# Debian / Ubuntu
apt-get update && apt-get install --only-upgrade wazuh-manager=4.14.8-1

# RHEL / CentOS / Rocky
yum install wazuh-manager-4.14.8-1

# Restart the manager after upgrade
systemctl restart wazuh-manager