CVE-2026-61802

Analyzed Analyzed - Analysis Complete

Information Disclosure in Wazuh API Cluster Key

Publication date: 2026-08-28

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to redact it. The REST API provides a masking control, mask_sensitive_config, that redacts sensitive fields such as authd.pass and cluster.key from configuration responses for users who lack update-config permission, and every config-read endpoint carries this decorator except GET /cluster/local/config. That endpoint, backed by read_config_wrapper, is gated only by cluster:read and returns the local node's cluster configuration including the cleartext key, whereas its siblings return the same value masked. As a result, any account with the default readonly or cluster_readonly role, which is explicitly denied update-config precisely so it cannot view secrets, receives the real cluster key. Because the cluster key authenticates and encrypts traffic between cluster nodes, disclosing it to an unprivileged account provides the authentication precondition for the cluster-peer remote code execution chains established by prior advisories. This issue is fixed in version 4.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-15

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-61802

Affected Vendors & Products

Vendor	Product	Version / Range
wazuh	wazuh	From 4.14.0 (inc) to 4.14.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in Wazuh versions 4.14.0 through 4.14.6 allows a low-privilege API user to read the cleartext cluster key from a configuration endpoint that fails to redact it. The GET /cluster/local/config endpoint returns the local node's cluster configuration including the cleartext key, while other similar endpoints mask sensitive fields for users without update permissions. This exposes the cluster key, which authenticates and encrypts traffic between cluster nodes.

Detection Guidance

Check if the GET /cluster/local/config endpoint returns the cluster key in cleartext by querying the API with a low-privilege user account. Use curl commands like: curl -u readonly_user:password http://localhost:55000/cluster/local/config and verify if cluster.key appears unmasked.

Impact Analysis

An attacker with access to the cluster key could authenticate as a cluster peer and potentially exploit existing Remote Code Execution (RCE) vulnerabilities in the cluster. This could lead to root-level access across nodes, compromising the entire Wazuh cluster environment.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing the cluster key, which authenticates and encrypts cluster traffic. Unauthorized access to this key may violate data protection requirements for confidentiality and integrity of sensitive data processed by the Wazuh cluster.

Mitigation Strategies

Upgrade Wazuh to version 4.14 or later where the issue is fixed. If upgrading is not immediately possible, restrict access to the GET /cluster/local/config endpoint by modifying firewall rules or API permissions to prevent unauthorized access.

Hi! I’m here to help you understand CVE-2026-61802. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70