CVE-2026-74033

6.1Medium

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

6.1Medium

Attack vector: Adjacent network
Complexity: Low
Privileges needed: High
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-22

Impact

A compromised Wazuh cluster worker node can read or delete arbitrary files on the master node, such as rbac.db. The attacker must already have high privileges or code execution on an internal cluster worker.

Root cause

The get_lists() and delete_list_file() CDB list cluster RPC handlers do not sanitize filenames against path traversal sequences or absolute paths.

Affected systems

Wazuh 4.1.1 before 4.14.8

CVSS v3.1 · CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Fix & remediation

Upgrade the Wazuh manager cluster to version 4.14.8 or later. If patching must wait, restrict network access to the Wazuh cluster communication port to trusted worker nodes only.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade wazuh-manager

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path, bypassing REST validation and RBAC to delete files like rbac.db.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-74033