CVE-2026-48024 wazuh CVE debrief

Who should care

Defenders responsible for Wazuh installations, especially those with cluster peers having access to the shared Fernet key, should assess exposure and prioritize patching. Security teams should verify Wazuh configuration file integrity and monitor for suspicious activity.

Why it matters

CVE-2026-48024 is a critical vulnerability in Wazuh that allows a cluster peer to write arbitrary files, including configuration files, leading to potential code execution. Defenders should prioritize patching, verify configuration file integrity, and monitor for suspicious activity.

• Code execution when Wazuh services reload.
• Configuration file tampering leading to potential security bypass.
• Potential for lateral movement within the cluster.
• Verification of Wazuh configuration file integrity is required.

Technical summary

The vulnerability exists in the cluster.unmerge_info() function in framework/wazuh/core/cluster/cluster.py and the process_files_from_worker() function in framework/wazuh/core/cluster/master.py. A cluster peer with the shared Fernet key can use path traversal to write arbitrary files, including configuration files such as /var/ossec/etc/ossec.conf, which can configure root-executed commands and lead to code execution when Wazuh services reload. This issue affects Wazuh versions from 4.0.0 to 4.14.6 and 5.0.0-beta3, and has been fixed in versions 4.14.6 and 5.0.0-beta3.

Defensive priority

Defenders should prioritize patching vulnerable Wazuh instances, especially in environments where cluster peers have access to the shared Fernet key. They should also verify the integrity of Wazuh configuration files and monitor for suspicious activity.

Recommended defensive actions

• Patch vulnerable Wazuh instances to versions 4.14.6 or 5.0.0-beta3.
• Verify the integrity of Wazuh configuration files.
• Monitor for suspicious activity in Wazuh cluster environments.
• Restrict access to the shared Fernet key.
• Implement additional security measures to detect and prevent exploitation.

Evidence notes

The vulnerability is caused by inadequate path confinement in the process_files_from_worker() function in framework/wazuh/core/cluster/master.py. A cluster peer can use traversal in files_metadata.json or a merged-file header to write files such as /var/ossec/etc/ossec.conf, which can configure root-executed commands and lead to code execution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.