CVE-2026-25770
Privilege Escalation in Wazuh Manager Enables Root RCE
Publication date: 2026-03-17
Last updated on: 2026-03-19
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wazuh | wazuh | From 3.9.0 (inc) to 4.14.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
| CWE-732 | The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. |
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-25770 is a critical privilege escalation vulnerability in the Wazuh Manager's cluster synchronization protocol affecting versions from 3.9.0 up to but not including 4.14.3."}, {'type': 'paragraph', 'content': "The vulnerability exists because the wazuh-clusterd service, which runs as the unprivileged 'wazuh' user, allows authenticated cluster nodes to write arbitrary files to the manager’s filesystem without proper path validation or directory restrictions."}, {'type': 'paragraph', 'content': 'Specifically, the service concatenates user-controlled relative file paths directly with the base path without sanitizing for path traversal, enabling an attacker to overwrite critical files like the main configuration file ossec.conf.'}, {'type': 'paragraph', 'content': "Because the ossec.conf file has insecure default permissions allowing the 'wazuh' user to write to it, an attacker can inject malicious command blocks into this configuration."}, {'type': 'paragraph', 'content': 'The wazuh-logcollector service, which runs as root, parses this poisoned configuration and executes the injected commands, resulting in full root remote code execution.'}, {'type': 'paragraph', 'content': "This breaks the security model by escalating privileges from the 'wazuh' user to root without requiring local user accounts or user interaction."}] [1]
How can this vulnerability impact me? :
This vulnerability allows an attacker with cluster credentials to gain full root remote code execution on the Wazuh Manager system.
With root access, the attacker can execute arbitrary commands, modify or delete critical files, disrupt services, and potentially move laterally within the network.
The attack requires network access to the Wazuh Cluster Protocol port and possession of the Cluster Key, which could be obtained through compromise of a worker node, insider knowledge, or leaked backups.
The impact includes complete loss of confidentiality, integrity, and availability of the affected system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "Detection of this vulnerability involves checking for unauthorized or suspicious writes to the Wazuh Manager's main configuration file (/var/ossec/etc/ossec.conf) and monitoring network activity on TCP port 1516, which is used by the Wazuh Cluster Protocol."}, {'type': 'paragraph', 'content': 'You can verify if your Wazuh Manager version is vulnerable by checking the installed version; versions starting from 3.9.0 up to before 4.14.3 are affected.'}, {'type': 'paragraph', 'content': 'Suggested commands include:'}, {'type': 'list_item', 'content': 'Check Wazuh Manager version: `wazuh-manager -v` or check package version via your package manager.'}, {'type': 'list_item', 'content': "Check permissions of the ossec.conf file: `ls -l /var/ossec/etc/ossec.conf` (look for group-write permissions allowing the 'wazuh' user to write)."}, {'type': 'list_item', 'content': 'Monitor recent changes to ossec.conf: `stat /var/ossec/etc/ossec.conf` or `ls -ltr /var/ossec/etc/ossec.conf`.'}, {'type': 'list_item', 'content': 'Search for suspicious <localfile> command blocks in ossec.conf that could indicate injection.'}, {'type': 'list_item', 'content': 'Monitor network connections on TCP port 1516 to detect unusual cluster protocol activity: `netstat -anp | grep 1516` or `ss -anp | grep 1516`.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate mitigation steps include:'}, {'type': 'list_item', 'content': 'Upgrade Wazuh Manager to version 4.14.3 or later, where the vulnerability is fixed.'}, {'type': 'list_item', 'content': "Harden the permissions of the main configuration file (/var/ossec/etc/ossec.conf) to prevent write access by the 'wazuh' user. Set permissions to root:wazuh with mode 640 (e.g., `chmod 640 /var/ossec/etc/ossec.conf` and `chown root:wazuh /var/ossec/etc/ossec.conf`)."}, {'type': 'list_item', 'content': 'Enforce strict chroot or allowlist restrictions in the wazuh-clusterd service to limit file writes to safe directories such as /var/ossec/var/cluster/incoming and reject writes to sensitive paths.'}, {'type': 'list_item', 'content': 'Restrict access to the cluster key and monitor for any unauthorized access to cluster credentials.'}, {'type': 'list_item', 'content': 'Monitor network traffic on TCP port 1516 and audit cluster node activities to detect and prevent exploitation attempts.'}] [1]