CVE-2026-74040

Summary

A Wazuh cluster worker can overwrite critical master configuration files like ossec.conf and agent.conf through a path traversal vulnerability in MasterHandler.process_files_from_worker, allowing attackers to achieve remote code execution across the entire manager and all connected agents.

Exploitability

Exploitation requires controlling a cluster worker node with high privileges, which is moderately difficult but achievable through various attack vectors including compromised worker nodes or privilege escalation, and leverages a trailing-slash basename bypass to overwrite protected files.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code as root on the Wazuh manager and all connected agents, potentially leading to complete cluster compromise and data exfiltration across the entire security infrastructure.

Detection

Monitor for unusual file modification patterns in the Wazuh manager's configuration directory, particularly ossec.conf and agent.conf, and watch for unexpected network traffic from worker nodes to master nodes with trailing-slash paths in file transfer requests.

Prioritized remediation

Upgrade to Wazuh 4.14.8 or later to remediate this arbitrary file overwrite vulnerability in the cluster worker-to-master file processing functionality.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.