CVE-2026-46343 wazuh CVE debrief

Who should care

Wazuh users and administrators should assess exposure and prioritize upgrading to fixed versions 4.14.6 or 5.0.0-beta2. They should also restrict cluster node authentication and authorization to prevent exploitation. Additionally, defenders should monitor for suspicious file deletion activity and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

Defenders should care because this vulnerability allows a cluster-authenticated node to delete files outside the WAZUH_PATH directory, potentially disrupting Wazuh manager functionality and cluster connectivity. Wazuh users and administrators should assess exposure, prioritize upgrading to fixed versions 4.14.6 or 5.0.0-beta2, and restrict cluster node authentication to prevent exploitation.

• Deletion of critical configuration files like ossec.conf or jwt_secret.json
• Invalidation of API tokens and disruption of cluster and API connectivity
• Potential disablement of the Wazuh manager process

Technical summary

The WazuhCommon.end_receiving_file() function in framework/wazuh/core/cluster/common.py allows a cluster-authenticated node to delete files outside the WAZUH_PATH directory due to improper canonicalization and confinement of filenames. This vulnerability enables an attacker to target critical configuration files like ossec.conf, jwt_secret.json, and TLS certificates, potentially disrupting Wazuh manager functionality and cluster connectivity. The issue is fixed in versions 4.14.6 and 5.0.0-beta2, and defenders should prioritize verifying and upgrading to these fixed versions.

Defensive priority

Defenders should prioritize verifying and upgrading to fixed versions 4.14.6 or 5.0.0-beta2, and restrict cluster node authentication.

Recommended defensive actions

• Verify Wazuh version and upgrade to 4.14.6 or 5.0.0-beta2 if necessary
• Restrict cluster node authentication and authorization
• Monitor for suspicious file deletion activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed versions. The issue is rooted in the WazuhCommon.end_receiving_file() function in framework/wazuh/core/cluster/common.py. Cluster-authenticated nodes can exploit this vulnerability to delete files outside the WAZUH_PATH directory, potentially disrupting Wazuh manager functionality and cluster connectivity. Defenders should verify and upgrade to fixed versions 4.14.6 or 5.0.0-beta2, restrict cluster node authentication, and monitor for any

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.