CVE-2026-61783

Analyzed Analyzed - Analysis Complete

Exposed Cluster Secret in Wazuh Manager Configuration

Publication date: 2026-08-28

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is disabled by any update-config RBAC rule, including an explicit deny. The mask_sensitive_config() decorator applies masking only when _has_update_permissions() returns false, but that gate treats a user as able to update the config whenever a manager:update_config or cluster:update_config rule exists, without ever checking whether the rule's effect is allow or deny. Because a deny rule is stored as a real entry, a read-only account that is hardened by explicitly denying config edits is counted as having update permission, which turns masking off. A single authenticated GET request to the configuration endpoint with raw=true then returns the verbatim ossec.conf XML with cluster.key in clear, whereas an otherwise identical account without the deny rule sees the value masked. This issue is fixed in version 4.14.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-15

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-61783

Affected Vendors & Products

Vendor	Product	Version / Range
wazuh	wazuh	From 4.14.0 (inc) to 4.14.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in Wazuh versions 4.14.0 through 4.14.6 allows an authenticated low-privilege user to read the cluster secret from the manager configuration. The issue occurs because the system incorrectly treats deny rules as granting update permissions, disabling sensitive value masking. A GET request to the configuration endpoint with raw=true returns the cluster.key in clear text.

Detection Guidance

Check Wazuh Manager versions 4.14.0 through 4.14.6 for unauthorized access to the cluster.key secret via the GET /configuration?raw=true endpoint. Review RBAC rules for deny entries in manager:update_config or cluster:update_config permissions that may incorrectly grant update access.

Impact Analysis

An attacker with low privileges could access the cluster.key, potentially compromising the security of the Wazuh cluster. This could lead to unauthorized access, data breaches, or further exploitation of the system. The high CVSS score of 7.0 reflects the significant confidentiality impact.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA. Exposure of the cluster.key may result in non-compliance with security and privacy standards.

Mitigation Strategies

Upgrade Wazuh Manager to version 4.14.7 or later to apply the fix for the RBAC permission check. Review and adjust RBAC rules to ensure deny entries do not inadvertently grant update permissions. Monitor for unauthorized access attempts to the configuration endpoint.

Hi! I’m here to help you understand CVE-2026-61783. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70