CVE-2026-46343 wazuh CVE debrief

Who should care

Wazuh users and administrators should assess their exposure to this vulnerability, especially those with cluster-authenticated nodes. They should verify their Wazuh version and apply patches if necessary to prevent potential file deletions and associated disruptions.

Why it matters

CVE-2026-46343 is a high-severity vulnerability in Wazuh that allows cluster-authenticated nodes to delete files outside the Wazuh installation directory. Wazuh users, especially those with cluster deployments, should assess their exposure, verify their version, and apply patches to prevent potential disruptions. The vulnerability can lead to the deletion of critical configuration files, impacting Wazuh manager functionality, API tokens, and cluster connectivity. Verification and patch application are crucial to maintaining the security and integrity of Wazuh deployments.

• Disruption of Wazuh manager functionality due to critical file deletion.
• Invalidation of API tokens, potentially impacting API connectivity and user access.
• Potential disruption of cluster connectivity and communication.
• Verification priority for Wazuh users to ensure patch application and configuration integrity.

Technical summary

The WazuhCommon.end_receiving_file() function in framework/wazuh/core/cluster/common.py allows a cluster-authenticated node to delete files outside the Wazuh installation directory due to improper handling of file paths. This can lead to the deletion of critical configuration files, such as ossec.conf, jwt_secret.json, TLS certificates, and ruleset files, potentially disabling the Wazuh manager, invalidating API tokens, or disrupting cluster and API connectivity.

Defensive priority

High priority for Wazuh users to assess exposure and apply patches.

Recommended defensive actions

• Assess Wazuh deployment for exposure to unpatched versions.
• Verify and apply patches to Wazuh versions 4.0.0 through 4.14.5 and 5.0.0-beta1.
• Review and update Wazuh configurations to restrict node access.
• Monitor Wazuh logs for suspicious file deletion activity.
• Perform vulnerability scanning to identify exposed Wazuh deployments.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions and retest remediated assets to ensure patch application and configuration integrity.

Evidence notes

The issue is fixed in Wazuh versions 4.14.6 and 5.0.0-beta2. Users should verify their version and apply patches if necessary. The vulnerability affects Wazuh versions from 4.0.0 until 4.14.5 and 5.0.0-beta1. Evidence is based on official CVE Program records and NIST NVD detail pages. Limited source detail is available; explicit evidence limits apply.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.