External risk intelligence

Wazuh Cluster File Path Traversal Vulnerability Allows Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-49441

The vulnerability exists within the internal cluster communication mechanism of the Wazuh platform. Exploitation requires a compromised cluster peer possessing the shared Fernet key to perform actions. This communication occurs between internal nodes rather than over the public internet, making public-facing exploitation unlikely in standard, properly configured deployments.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a security vulnerability in the Wazuh threat detection platform that could allow an attacker with authenticated access to a cluster peer to overwrite critical configuration files, potentially leading to the execution of arbitrary commands. The core issue lies in how the platform handles file paths during internal cluster communications, allowing for the circumvention of security checks.

Trusted file paths can be manipulated.
It impacts secure configuration and command execution.
Confirm relevance and exposure within your Wazuh clusters.

Attack Path

How an attacker could exploit the issue

An attacker with administrative privileges within a Wazuh cluster could exploit this vulnerability by submitting a crafted archive to a worker node. This archive, by manipulating the `file_path` in `files_metadata.json`, allows the attacker to overwrite critical configuration files like `ossec.conf`. Once the `ossec.conf` is replaced, the attacker can configure the system to execute commands with root privileges, leading to code execution upon service restart.

Requires privileged cluster access.
Uploads crafted archive to worker node.
Leads to root command execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a cluster peer with the shared Fernet key could overwrite security-sensitive files like `ossec.conf`. Replacing this configuration file can lead to the execution of root-level commands after a service reload, potentially resulting in code execution.

Wazuh configuration files.

-Uploading a crafted archive. -Code execution on the Wazuh server.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Wazuh platform's internal cluster communication is the likely area of impact for this vulnerability. Teams responsible for managing the Wazuh deployment, including infrastructure and security operations, should take the lead. The first step is to identify all Wazuh cluster nodes, verify their configuration and patch status, and then prioritize remediation based on the criticality of the affected components and the potential for compromise.

Wazuh platform and infrastructure teams.

-Verify cluster peer configuration and Fernet key security. -Plan and apply updates during a maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Wazuh?

Wazuh is an open-source security platform designed for threat detection, prevention, and incident response. It monitors system integrity, detects anomalies, and analyzes logs across an organization's infrastructure. By using a cluster-based architecture, it allows different nodes to communicate and share data, which is where this vulnerability specifically resides.

How does this vulnerability work?

This issue is a file path traversal flaw (CWE-73). The software fails to properly restrict file paths provided by a cluster peer during internal communications. By sending a specially crafted archive, an attacker can bypass intended directory constraints and overwrite critical system configuration files, such as ossec.conf, potentially leading to unauthorized command execution with root privileges.

What is required to trigger this bug?

An attacker must already have compromised a cluster peer and possess the shared Fernet key used for encryption within the Wazuh cluster. Simply interacting with the platform normally or accessing a public-facing component does not trigger this. The vulnerability relies on abusing the internal trust mechanism between existing, authenticated nodes in the cluster.

Is my Wazuh deployment at risk?

According to Halo Surface Signal, exploitation is unlikely for standard, properly configured deployments because the issue involves internal node-to-node communication rather than direct public internet exposure. You should evaluate the risk based on the security of your internal cluster nodes and whether you have effectively protected the shared Fernet keys.

What should I do to address CVE-2026-49441?

The most effective step is to update your Wazuh installation to version 4.14.6 or 5.0.0-beta3, which contain the fix. Ensure your infrastructure team inventories all cluster nodes to verify their patch status. Until you can update, prioritize securing the shared Fernet keys and restricting access to your cluster peer nodes to trusted administrators only.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.