CVE-2026-74043

Summary

A path traversal vulnerability in Wazuh's cluster file upload functions allows malicious cluster workers to write files anywhere on the filesystem as the wazuh user, potentially leading to arbitrary code execution or data compromise.

Exploitability

Moderately difficult to exploit as it requires an attacker to already possess the cluster key and have access to a cluster worker node, but once achieved, allows for arbitrary file writes with high privileges.

Blast radius

The vulnerability could impact all Wazuh cluster nodes that allow file uploads, potentially leading to full cluster compromise, data exfiltration, or persistence mechanisms being established by attackers.

Detection

Monitor for unusual file creation patterns in the Wazuh installation directory and its subdirectories, particularly around configuration files and logs, as well as network traffic to the cluster API endpoints related to file uploads.

Prioritized remediation

Upgrade to Wazuh 4.14.8 or later to remediate this path traversal vulnerability in the cluster file upload functions.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.