CVE-2026-61800

Analyzed Analyzed - Analysis Complete

Path Traversal in Wazuh Leading to Remote Code Execution

Publication date: 2026-08-28

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code execution as root. During cluster file synchronization, the non-merged branch of update_master_files_in_worker() moves each staged file to a destination derived only from safe_join(), which confines the path to /var/ossec but never verifies that the file lands in the directory declared by its cluster_item_key. Because the destination check present on the primary node and on the worker's merged branch was not applied, a peer can place files at attacker-chosen locations under /var/ossec, including paths that are executed as root, and the delete branch has the same gap. This is an incomplete fix for CVE-2026-30893, which addressed traversal outside /var/ossec but left this path able to redirect files anywhere within it. This issue is fixed in version 4.14.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-15

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-61800

Affected Vendors & Products

Vendor	Product	Version / Range
wazuh	wazuh	From 4.4.0 (inc) to 4.14.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-61800 is a high-severity vulnerability in Wazuh versions 4.4.0 through 4.14.6. It allows a party with the cluster key to write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code execution as root. The issue stems from an incomplete fix for CVE-2026-30893, where a missing directory confinement check in the cluster worker file sync process enables attackers to place files anywhere within /var/ossec, including paths executed as root.

Detection Guidance

To detect this vulnerability, check Wazuh versions between 4.4.0 and 4.14.6. Verify if cluster workers allow arbitrary file writes in /var/ossec by inspecting file operations logs. Look for unauthorized modifications in critical directories like active-response/bin/, wodles/, or etc/. Use commands like 'ls -la /var/ossec' to check for unexpected files or timestamps.

Impact Analysis

This vulnerability allows an attacker with master privileges or access to the cluster key to execute arbitrary code as root on all worker nodes. This could lead to full system compromise, data theft, unauthorized access, or disruption of services. Attackers could install malware, modify system configurations, or delete critical files, impacting confidentiality, integrity, and availability of the affected systems.

Compliance Impact

This vulnerability could severely impact compliance with GDPR, HIPAA, and other regulations. It may lead to unauthorized access to sensitive data, violating confidentiality requirements. Additionally, the inability to ensure system integrity and availability could result in non-compliance with security and privacy controls mandated by these standards.

Mitigation Strategies

Upgrade Wazuh to version 4.14.7 or later immediately. Ensure cluster keys are not compromised and restrict access to master roles. Review /var/ossec for unauthorized files and remove any suspicious entries. Monitor network traffic for integrity sync anomalies.

Hi! I’m here to help you understand CVE-2026-61800. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70