CVE-2026-74031

6.5Medium

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None
Impact: High impact on integrity, availability
Weakness: CWE-22

Impact

Attackers possessing the cluster key can delete arbitrary files owned by the wazuh user, including ossec.conf and client.keys. This requires compromised cluster worker access or possession of the shared cluster key.

Root cause

The delete_rule_file and delete_decoder_file helper functions fail to validate path traversal sequences in the filename parameter.

Affected systems

Wazuh 4.1.1 before 4.14.8

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Fix & remediation

Upgrade Wazuh manager and cluster nodes to version 4.14.8 or later. If patching immediately is not possible, restrict network access to the Wazuh cluster communication ports and rotate the cluster key if compromised.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade wazuh-manager

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attackers holding the cluster key can invoke these helpers through DistributedAPI with traversal sequences to delete ossec.conf, client.keys, or rules as the wazuh user.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-74031