CVE-2026-44252
Received Received - Intake

Wazuh Manager Fernet Key Disclosure Leading to Privilege Escalation

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API user with manager:read permission to retrieve the cluster key from the element in ossec.conf through GET /manager/configuration?raw=true. An attacker with network access to TCP port 1516 can use the disclosed Fernet key to impersonate a cluster worker and submit distributed API requests containing attacker-controlled rbac_permissions with rbac_mode set to black. Because the master trusts the worker-supplied authorization context, the attacker can create users, assign administrator roles, access credentials and API tokens, modify configuration, and execute actions across agents. This issue is fixed in version 4.14.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-44252
EUVD
EUVD-2026-62551

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
wazuh wazuh_manager 4.0.0
wazuh wazuh_manager 4.14.4
wazuh wazuh_manager 4.14.5
wazuh wazuh_manager 5.0.0_beta3
wazuh wazuh_manager From 4.0.0 (inc) to 4.14.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-44252 is a privilege escalation vulnerability in Wazuh Manager versions 4.0.0 to 4.14.4. A low-privilege read-only API user with manager:read permission can retrieve the cluster key from the ossec.conf file via the GET /manager/configuration?raw=true endpoint. The attacker can then impersonate a cluster worker using this key and submit malicious distributed API requests with elevated RBAC permissions, gaining full administrative access.

Detection Guidance

Check if your Wazuh Manager version is below 4.14.5. Run: wazuh-control -V. If version is 4.0.0 to 4.14.4, the system is vulnerable. Also verify if port 1516 is accessible from untrusted networks using netstat -tulnp | grep 1516 or ss -tulnp | grep 1516.

Impact Analysis

An attacker can create or modify users and roles, access credentials and API tokens, modify configurations, and execute actions across all agents. This could lead to unauthorized system control, data breaches, or disruption of services if exploited.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, unauthorized disclosures, and failure to maintain proper access controls, potentially leading to regulatory penalties.

Mitigation Strategies

Upgrade Wazuh Manager to version 4.14.5 or later immediately. Restrict network access to TCP port 1516 using firewalls to trusted sources only. Review API user permissions and remove unnecessary manager:read access for low-privilege users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44252. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart