CVE-2026-74044
Received Received - Intake

Path Traversal in Wazuh Agent via Cluster Hello Payload

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a malicious node name and disconnect, triggering the master's peer cleanup routine to remove the contents of arbitrary directories within the Wazuh installation path writable by the wazuh user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-74044
EUVD
EUVD-2026-61076

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wazuh wazuh to 4.14.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74044 is a path traversal vulnerability in Wazuh versions 4.0.0 through 4.14.5. It allows authenticated cluster peers with a valid Fernet key to delete arbitrary directory contents by sending a crafted node name in the cluster hello payload. The master node does not validate the node name, enabling attackers to manipulate the peer cleanup routine and remove files from any writable directory within the Wazuh installation path.

Detection Guidance

Check Wazuh cluster logs for suspicious node names containing path traversal sequences like '../' or '/etc/' in cluster hello payloads. Review logs for unexpected peer disconnections followed by directory cleanup operations. Inspect /var/ossec/logs/cluster.log for entries with node names containing special characters or traversal patterns.

Impact Analysis

This vulnerability can lead to loss of critical files such as custom rules, decoders, or configuration files like ossec.conf. In severe cases, it may cause a denial of service if key configuration files are deleted. The attack is silent, with the only indicator being a malicious node name in logs.

Mitigation Strategies

Upgrade Wazuh to version 4.14.6 or later immediately. Ensure no unauthorized cluster peers have access to the Fernet key. Review and restrict permissions on /var/ossec/ directories to limit write access by the wazuh user. Monitor for signs of exploitation in cluster logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74044. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart