External risk intelligence

Wazuh cluster path traversal allows remote code execution.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-48024

The vulnerability exists within the cluster synchronization mechanism between internal Wazuh nodes. It requires a peer already holding the shared authentication key to exploit, meaning it is not exposed to the public internet and is typically restricted to internal management or cluster-to-cluster communication channels.

Path Traversal

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability found in the Wazuh platform, a system used for threat prevention and detection. The flaw allows an authenticated peer within the Wazuh cluster to potentially overwrite critical configuration files, leading to the execution of unauthorized commands. The main concern is confirming relevance and exposure within our Wazuh deployments.

Attackers can hijack Wazuh configurations.
Centralized security systems are a high-value target.
Confirm if Wazuh is deployed and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker who has already compromised a cluster peer with the shared Fernet key can manipulate file synchronization to write arbitrary files to the Wazuh manager. This could involve overwriting the `ossec.conf` configuration file, enabling the attacker to execute root-level commands when Wazuh services reload, potentially leading to full system compromise.

Requires authenticated peer access.
Triggers via crafted synchronization data.
Risk of remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When Wazuh services are reloaded, a cluster peer holding the shared Fernet key could exploit path traversal to replace the ossec.conf file, enabling the configuration of root-executed commands and leading to code execution.

System configuration files at risk.
Path traversal allows file overwrites.
Remote code execution on Wazuh nodes.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world action for this critical vulnerability requires immediate identification and assessment by teams managing the Wazuh platform. The first practical step is to locate all instances of the affected Wazuh versions, determine their network exposure and business criticality, and then identify the specific team or individual accountable for their upkeep. Subsequently, a risk-based remediation plan should be developed, which may involve vendor coordination for updates or the implementation of compensating controls if immediate patching is not feasible.

Wazuh platform owners should lead remediation efforts.
Verify Wazuh cluster synchronization configuration and reachability.
Plan and execute necessary updates or mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Wazuh and how is it used?

Wazuh is an open-source security platform designed for threat prevention, detection, and incident response. It helps organizations monitor their infrastructure by collecting and analyzing security data. The platform often functions in a clustered environment, where a master node coordinates with worker nodes to synchronize security policies and configuration information across the network.

How does CVE-2026-48024 trigger a path traversal vulnerability?

This vulnerability, classified as CWE-22, involves improper path validation during cluster synchronization. When nodes share information, the system fails to verify that incoming file paths remain within the intended directory. Because the software does not adequately restrict these paths, a malformed synchronization package can force the system to write files into sensitive locations outside the designated cluster storage.

Do I need an active compromise for this bug to trigger?

Yes, exploiting this vulnerability requires a specific precondition: possession of the cluster's shared Fernet key. An attacker must have already compromised an existing peer node to participate in the synchronization process. Simply sending random network traffic to a Wazuh node will not trigger this flaw, as the system requires valid, authenticated participation in the cluster communication to process the malicious file paths.

Is my Wazuh deployment at risk according to Halo Surface Signal?

Halo Surface Signal indicates that risk is unlikely for direct internet-facing exposure. Because the vulnerability exists within internal cluster synchronization channels, it requires access to the restricted peer-to-peer network. If your Wazuh cluster nodes are isolated from unauthorized segments and protected by strict internal access controls, the likelihood of an attacker reaching the required synchronization state is significantly lower.

When should I prioritize patching for CVE-2026-48024?

You should prioritize this when managing Wazuh versions between 4.0.0 and 4.14.5 or 5.0.0-beta1 through beta2. The first step is to identify all running instances and confirm their current version. Since this allows unauthorized root-level command execution, teams should schedule an update to version 4.14.6 or 5.0.0-beta3 as soon as possible to permanently close the path traversal weakness and secure the cluster synchronization mechanism.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.