External risk intelligence

Wazuh Cluster API Path Traversal Allows Private Key Disclosure

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-48162

The vulnerability exists within the Wazuh cluster communication channel, which is intended for peer-to-peer synchronization between nodes in a private deployment. While network-reachable, this cluster communication is typically restricted to internal infrastructure and not exposed to the public internet.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a security vulnerability in the Wazuh platform, specifically within its distributed API component. The issue allows a compromised cluster peer to potentially access sensitive system files, including private keys, which could then be used to forge administrative tokens and gain unauthorized control. The main concern is confirming relevance and exposure given the specific operational context.

A flaw could expose sensitive system files.
It enables unauthorized administrative control.
Confirm relevance and exposure of Wazuh deployments.

Attack Path

How an attacker could exploit the issue

An attacker with administrative access to a Wazuh cluster peer can leverage a path traversal vulnerability in the `send_tmp_file()` function. By manipulating the `tmp_file` parameter, they can trick the master node into returning the content of any readable file. If the attacker obtains the private key for the cluster, they can forge administrator tokens to gain full control over the API.

Requires a cluster peer with administrative access.
Triggered by crafting a malicious file path.
Allows forging admin tokens and full API control.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a Wazuh cluster peer could use path traversal to trick the master into returning sensitive files. If the master returns the private key, a peer could forge administrator API tokens offline to gain administrative privileges.

Sensitive files from the Wazuh master.
Path traversal to read arbitrary files.
Unauthorized administrative access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Wazuh's DistributedAPI could allow a cluster peer to gain administrative privileges by reading sensitive files. Ownership likely falls to the platform or infrastructure team managing the Wazuh deployment, requiring coordination with security teams. The first practical step is to identify all cluster peers, confirm their reachability within the internal network, and assess the criticality of the affected Wazuh instances.

Platform/infrastructure team owns remediation.
Verify all cluster peer configurations.
Plan internal patching or access control.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Wazuh?

Wazuh is an open-source security platform designed for threat prevention, detection, and incident response. It is frequently used by security and infrastructure teams to monitor endpoints, analyze logs, and manage configuration compliance across large networks by deploying agents that report back to a centralized server.

What is the vulnerability in CVE-2026-48162?

This vulnerability is a Path Traversal issue, classified as CWE-73. It occurs because the system fails to properly validate or restrict file paths provided to the DistributedAPI. Consequently, an attacker can manipulate file requests to bypass intended directory boundaries and read sensitive system files on the master node.

How is this vulnerability triggered?

An attacker must already control a cluster peer that possesses the shared Fernet key to communicate with the master node. By sending a specially crafted request to the DistributedAPI, the peer can access arbitrary files. Simply having network access to the API without the shared key or peer-level privileges does not trigger this specific flaw.

Is my Wazuh deployment at risk?

Halo Surface Signal indicates that this vulnerability is unlikely to be exposed to the public internet because it exists within the internal cluster communication channel. Your primary concern should be unauthorized access to your internal network; if a peer node is compromised, the security of the entire cluster is impacted.

Do I need to update Wazuh?

Yes, you should update to version 4.14.6 or 5.0.0-beta3 to remediate this issue. As a first step, identify all nodes participating in your Wazuh clusters, verify their network reachability, and ensure that access to the cluster communication channel is strictly restricted to trusted administrative systems.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.