CVE-2026-44252 wazuh CVE debrief

Who should care

Organizations using Wazuh Manager versions 4.0.0 through 4.14.4, security teams responsible for monitoring and protecting Wazuh Manager instances, and administrators of Wazuh Manager systems should prioritize upgrading to version 4.14.5 or later to mitigate this vulnerability. Additionally, teams should review and implement defensive measures such as restricting API access, monitoring logs, and enhancing security controls.

Technical summary

A vulnerability in Wazuh Manager versions 4.0.0 through 4.14.4 allows a low-privilege read-only API user with manager:read permission to retrieve the cluster key from the element in ossec.conf through GET /manager/configuration?raw=true. An attacker with network access to TCP port 1516 can use the disclosed Fernet key to impersonate a cluster worker and submit distributed API requests containing attacker-controlled rbac_permissions with rbac_mode set to black. The master trusts the worker-supplied authorization context, allowing the attacker to create users, assign administrator roles, access credentials and API tokens, modify configuration, and execute actions across agents.

Defensive priority

Organizations using Wazuh Manager versions 4.0.0 through 4.14.4 should prioritize upgrading to version 4.14.5 or later to mitigate this vulnerability.

Recommended defensive actions

• Upgrade Wazuh Manager to version 4.14.5 or later
• Restrict access to the Wazuh Manager API to trusted users and networks
• Monitor Wazuh Manager logs for suspicious activity
• Implement additional security controls to detect and prevent unauthorized access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Wazuh Manager versions 4.0.0 through 4.14.4. Evidence is based on official CVE and NVD records, as well as references from the Wazuh GitHub repository. The vulnerability allows for unauthorized access and potential elevation of privileges. Defensive measures include restricting access to the Wazuh Manager API, monitoring logs for suspicious activity, and implementing additional security controls.

Official resources