Code Execution in Wazuh via Malicious sort_casting Parameter

Executive Summary

CVE-2026-44901 is a remote code execution vulnerability in Wazuh's Cluster DAPI Protocol affecting versions 4.0.0 to 4.14.6 and 5.0.0-beta2. The flaw exists in the AffectedItemsWazuhResult.merge() function where the sort_casting field is deserialized from JSON responses without validation. An attacker can send a crafted JSON payload with sort_casting set to exec and a malicious Python payload in affected_items. When the master node merges responses from multiple workers, it executes the payload as root via exec().

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Wazuh Manager version is between 4.0.0 and 4.14.5 or 5.0.0-beta2. Run: wazuh-control -v to check the version. Inspect logs for suspicious cluster API requests with sort_casting=exec in JSON payloads.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with control over a worker node to execute arbitrary code on the master node with root privileges. This could lead to full system compromise, unauthorized access to sensitive data, installation of malware, or disruption of services. The attack requires a compromised worker node and specific node ordering in requests.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive personal or health data. A successful exploit could lead to data breaches, violating confidentiality requirements. Organizations using affected Wazuh versions may face regulatory penalties, loss of certification, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Wazuh Manager to version 4.14.6 or later immediately. If upgrading is not possible, restrict network access to the Wazuh cluster API and monitor for unauthorized exec calls in logs.

Useful 0 Not Useful 0