CVE-2026-28220
Received Received - Intake

Remote Code Execution in Wazuh Cluster API

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API (DAPI) handling allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to make the master node deserialize an attacker-controlled callable and execute it under an attacker-controlled RBAC context. The cluster code in `framework/wazuh/core/cluster/common.py` deserializes JSON with `as_wazuh_object()`, which resolves any callable whose top-level package is wazuh or api (an overly broad allowlist controlled only by `ALLOWED_CALLABLES_PACKAGES`), and DAPI requests handled in framework/wazuh/core/cluster/dapi/dapi.py accept a client-supplied rbac_permissions value that `run_local()` applies as the global RBAC context, so supplying an rbac_mode of black causes authorization checks for expose_resources-protected functions to pass without any legitimate permission assignment. Combined, these allow privileged administrative actions on the master node such as arbitrary file writes under WAZUH_PATH, creation of new API users, and tampering with security.yaml, and can be chained into full manager compromise. This issue has been fixed in version 4.14.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-28220
EUVD
EUVD-2026-45978

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
wazuh wazuh to 4.14.5 (exc)
wazuh wazuh 4.14.5
wazuh wazuh From 4.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-28220 is a vulnerability in Wazuh's Cluster Distributed API (DAPI) that allows a cluster peer or any authenticated actor to execute privileged functions on the master node. It involves unsafe callable deserialization and RBAC context injection, enabling actions like arbitrary file writes, creating backdoor API users, and tampering with security configurations.

Detection Guidance

To detect this vulnerability, check if your Wazuh cluster is running a version prior to 4.14.5. Use the command: wazuh-control -v to verify the installed version. Additionally, monitor for unauthorized API calls or unexpected administrative actions in cluster logs located in /var/ossec/logs/cluster.log.

Impact Analysis

This vulnerability allows attackers to perform privileged administrative actions such as writing arbitrary files, creating new API users, and modifying security.yaml. It can lead to full manager compromise, persistence through backdoor users, and broader fleet compromise if exploited.

Compliance Impact

This vulnerability allows unauthorized actors to execute privileged administrative actions on the Wazuh master node, such as tampering with security configurations like security.yaml, creating backdoor API users, and performing arbitrary file writes. Such unauthorized access could lead to data breaches, unauthorized data exposure, or manipulation of security logs, which directly violates compliance requirements under GDPR and HIPAA for data integrity, confidentiality, and access controls.

Mitigation Strategies

Immediately upgrade Wazuh to version 4.14.5 or later. Ensure the cluster key is not exposed and restrict access to the cluster channel. Review API logs for suspicious activity and revoke any unauthorized API users created during the vulnerability window.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28220. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart