CVE-2026-74031
Received Received - Intake

Path Traversal in Wazuh Agent via Cluster API

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attackers holding the cluster key can invoke these helpers through DistributedAPI with traversal sequences to delete ossec.conf, client.keys, or rules as the wazuh user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-74031
EUVD
EUVD-2026-98669

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wazuh wazuh-manager 4.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74031 is a path traversal vulnerability in Wazuh versions 4.1.1 to 4.14.7 that allows authenticated cluster workers with the cluster key to delete arbitrary files by exploiting unvalidated filename parameters in the delete_rule_file and delete_decoder_file helper functions. Attackers can traverse directories to delete critical files such as ossec.conf, client.keys, or rules, executing actions as the wazuh user.

Detection Guidance

Check Wazuh manager version with 'wazuh-control -V' or 'rpm -qa | grep wazuh-manager'. If version is below 4.14.8, the system is vulnerable. Monitor cluster logs for suspicious delete_rule_file or delete_decoder_file API calls in /var/ossec/logs/cluster.log.

Impact Analysis

This vulnerability can disrupt Wazuh manager functionality, disable agent authentication, or blind detection capabilities by deleting critical files. Attackers could remove configuration files, rule sets, or keys, leading to system instability or security gaps.

Mitigation Strategies

Upgrade Wazuh manager to version 4.14.8 or later immediately. Restrict cluster key access to authorized personnel only. Review and remove unnecessary permissions for cluster workers. Monitor for unauthorized file deletions in critical directories like /var/ossec/etc.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74031. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart