CVE-2026-74033
Received Received - Intake

Path Traversal in Wazuh Cluster Files

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path, bypassing REST validation and RBAC to delete files like rbac.db.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-74033
EUVD
EUVD-2026-98671

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wazuh wazuh-manager 4.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74033 is a path traversal vulnerability in Wazuh versions 4.1.1 to 4.14.7. It affects the get_lists() and delete_list_file() functions in the CDB list cluster handlers. The flaw allows compromised cluster workers to read or delete files on the master node by sending traversal sequences or absolute paths through the internal cluster RPC interface. This bypasses REST validation and RBAC, potentially enabling deletion of critical files such as rbac.db.

The vulnerability has a CVSS score of 8.4 (High) and exists because the functions do not validate that resolved filesystem paths stay within the intended USER_LISTS_PATH directory.

Detection Guidance

Check Wazuh manager versions between 4.1.1 and 4.14.7 for potential exposure. Monitor cluster RPC traffic for unusual file path requests or deletions targeting critical files like rbac.db. Review logs for unauthorized access attempts to restricted directories.

Impact Analysis

If you use Wazuh versions between 4.1.1 and 4.14.7, a compromised cluster worker could exploit this to read sensitive files on the master node or delete critical files like the RBAC database. This could lead to unauthorized access, data loss, or system compromise without requiring master-side credentials.

Compliance Impact

This vulnerability could lead to unauthorized access or deletion of sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized file access or deletion could result in data breaches, loss of audit trails, or failure to maintain data integrity, potentially leading to regulatory penalties.

Mitigation Strategies

Upgrade Wazuh manager to version 4.14.8 or later immediately. Isolate compromised cluster workers if detected. Restrict internal cluster RPC access to trusted nodes only. Verify integrity of critical files like rbac.db after upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74033. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart