CVE-2026-44901 wazuh CVE debrief

Who should care

Defenders responsible for Wazuh instances, especially those with exposed cluster nodes or untrusted workers, should assess their exposure and prioritize patching. They should also verify cluster node integrity, monitor for suspicious activity, and implement compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-44901 allows code execution via crafted cluster worker responses in Wazuh. Defenders should prioritize patching, verify cluster node integrity, and monitor for suspicious activity.

• Code execution as root on master nodes
• Potential for lateral movement within clusters
• Need for verification of cluster node integrity
• Priority for patching and restricting access to untrusted workers

Technical summary

The `AffectedItemsWazuhResult.merge()` function in Wazuh's `framework/wazuh/core/results.py` does not properly validate the `sort_casting` field in cluster worker JSON responses. This allows an attacker to set `sort_casting` to `exec` and provide Python source code in `affected_items`, leading to code execution as root on the master node when merging responses from multiple nodes. The issue arises from a lack of validation and sanitization of user-supplied data in cluster worker responses, which can be exploited to execute arbitrary Python code.

Defensive priority

Defenders should prioritize patching Wazuh instances, especially those exposed to untrusted cluster workers, and verify the integrity of their cluster nodes.

Recommended defensive actions

• Patch Wazuh instances to version 4.14.6 or 5.0.0-beta2
• Verify cluster node integrity and restrict access to untrusted workers
• Monitor for suspicious activity in cluster nodes and API responses
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and patches. GitHub commits and release notes confirm the fix in versions 4.14.6 and 5.0.0-beta2. Evidence is limited to public sources and may not reflect all affected deployments or variations. Defenders should verify cluster node integrity, monitor for suspicious activity, and prioritize patching based on their exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.