CVE-2026-44252 wazuh CVE debrief

Who should care

Defenders responsible for Wazuh Manager instances, especially those with low-privilege API users, should assess exposure and apply the patch to prevent unauthorized access. This includes operators, platform administrators, vulnerability management teams, and security teams who need to prioritize verifying exposure and applying the patch in version 4.14.5.

Why it matters

Defenders should prioritize verifying exposure of Wazuh Manager instances, especially those with low-privilege API users, and apply the patch in version 4.14.5 to prevent unauthorized access. The vulnerability allows a low-privilege API user to retrieve the cluster key, enabling impersonation and unauthorized access. Evidence is available in the CVE record, NVD vulnerability detail, and referenced GitHub commits, pull requests, and release notes.

• Potential unauthorized access to Wazuh Manager instances
• Possible impersonation of cluster workers
• Potential creation of users with administrator roles
• Potential access to credentials and API tokens

Technical summary

The vulnerability in Wazuh Manager allows a low-privilege read-only API user with manager:read permission to retrieve the cluster key from the element in ossec.conf through GET /manager/configuration?raw=true. An attacker with network access to TCP port 1516 can use the disclosed Fernet key to impersonate a cluster worker and submit distributed API requests containing attacker-controlled rbac_permissions with rbac_mode set to black.

Defensive priority

Defenders should prioritize verifying exposure of Wazuh Manager instances, especially those with low-privilege API users, and apply the patch in version 4.14.5 to prevent unauthorized access.

Recommended defensive actions

• Verify Wazuh Manager instances for exposure, especially those with low-privilege API users
• Apply the patch in version 4.14.5 to prevent unauthorized access
• Restrict access to TCP port 1516 to trusted users only
• Monitor for suspicious API requests and implement additional security measures to detect and prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, its impact, and the fixed version. Additional details are available in the referenced GitHub commits, pull requests, and release notes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.