External risk intelligence

Wazuh Cluster File Synchronization Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-61800

The vulnerability exists within the internal cluster synchronization mechanism of Wazuh worker nodes. While the service communicates over a network, these nodes are typically deployed in isolated internal management segments and are not intended to be exposed to the public internet.

Path Traversal

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw in the Wazuh platform allows authenticated users to execute arbitrary code on worker nodes by manipulating file synchronization. This could lead to unauthorized access and control over critical systems.

Unauthorized file control allows code execution.
Confirms a need for ongoing internal security review.
Verify Wazuh platform exposure and internal configurations.

Attack Path

How an attacker could exploit the issue

An attacker with cluster key access could target worker nodes in a Wazuh deployment. By manipulating the cluster file synchronization process, they could place malicious files within the `/var/ossec` directory. If these files are configured to execute with root privileges, the attacker could achieve remote code execution.

Requires cluster key access.
Manipulates file synchronization.
Leads to root remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A privileged user with cluster key access could manipulate file synchronization to write, overwrite, or delete arbitrary files on worker nodes within the `/var/ossec` directory. This could lead to code execution as the root user under certain conditions, even though the initial fix for a related vulnerability did not fully address all path traversal possibilities within this directory.

Arbitrary file writes to worker nodes.
Malicious file placement during cluster sync.
Remote code execution as root.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Wazuh platform's cluster file synchronization mechanism is implicated, suggesting that platform or infrastructure teams responsible for managing Wazuh deployments should take the lead. The first critical step is to identify all Wazuh worker nodes, determine their network exposure and business criticality, and locate the accountable owner for each instance before planning any remediation.

Identify Wazuh worker node owners.
Verify cluster node reachability and criticality.
Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Wazuh and how is it used?

Wazuh is an open-source security platform designed to provide unified extended detection and response (XDR) and security information and event management (SIEM) capabilities. Organizations deploy it to monitor endpoints and cloud workloads, using a clustered architecture where a primary node coordinates with multiple worker nodes to collect and analyze security data across an infrastructure.

What kind of vulnerability is CVE-2026-61800?

This vulnerability is classified as Improper Limitation of a Pathname to a Restricted Directory, or CWE-22. In plain terms, it is a path traversal flaw. While the system is designed to prevent files from being written outside a specific folder, the logic fails to verify if a file is being placed in the exact subdirectory intended by the synchronization process, allowing unauthorized file placement.

How does an attacker trigger this file synchronization flaw?

The trigger requires a party to possess a valid cluster key, which is used for authentication between nodes. An attacker must abuse the cluster synchronization mechanism to send malicious file paths. Simply interacting with the Wazuh interface or service without this specific cryptographic key does not initiate the synchronization process required to exploit this flaw.

Is my Wazuh deployment at high risk?

Halo Surface Signal indicates this vulnerability is unlikely to be targeted externally because the affected synchronization mechanism is intended for internal cluster communication. Risk is highest if your worker nodes are reachable beyond isolated, internal management segments. Evaluate whether your cluster architecture is accessible from untrusted networks, as this increases the potential for unauthorized key usage.

What is the recommended first step for administrators?

Start by identifying all deployed Wazuh worker nodes and their respective owners within your organization. Confirm the network configuration for these nodes to understand if they are exposed internally or externally. Once inventory and reachability are mapped, prioritize updating to version 4.14.7, which corrects the directory validation logic to prevent arbitrary file placement.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.