CVE-2026-48162 wazuh CVE debrief

Who should care

Security teams and administrators responsible for Wazuh installations should assess exposure and apply patches to prevent potential unauthorized access and privilege escalation. This includes reviewing system configurations, verifying version and patch levels, and ensuring the shared Fernet key is properly secured. Additionally, security teams should monitor for suspicious activity and review compensating controls for exposed systems.

Why it matters

CVE-2026-48162 is a critical vulnerability in Wazuh that allows for potential unauthorized access and privilege escalation. Security teams and administrators should assess exposure and apply patches to prevent potential unauthorized file reading and disclosure of sensitive information.

• Potential unauthorized file reading and disclosure of sensitive information.
• Possible creation of forged administrator REST API tokens, leading to privilege escalation.
• Potential for lateral movement within the cluster if an attacker gains access to sensitive files or administrative privileges.
• Need for verification of Wazuh version and patch level to ensure remediation.

Technical summary

The DistributedAPI.send_tmp_file() function in Wazuh joins an attacker-controlled tmp_file value to WAZUH_PATH without canonicalization or confinement. This allows a cluster peer holding the shared Fernet key to use traversal or an absolute path to make the master return any readable file over the cluster channel. The vulnerability exists in Wazuh versions from 4.0.0 to 4.14.6 and 5.0.0-beta3. The issue is fixed in versions 4.14.6 and 5.0.0-beta3. A cluster peer holding the shared Fernet key can use traversal or an absolute path to make the master return any readable file over the cluster channel, potentially leading to unauthorized access and privilege escalation.

Defensive priority

High priority should be given to assessing exposure and applying patches, as this vulnerability allows for potential unauthorized access and privilege escalation.

Recommended defensive actions

• Assess exposure by checking if Wazuh versions 4.0.0 to 4.14.6 or 5.0.0-beta3 are in use.
• Apply patches to upgrade to Wazuh version 4.14.6 or 5.0.0-beta3.
• Verify that the shared Fernet key is properly secured and not accessible to unauthorized cluster peers.
• Monitor for suspicious activity, such as unusual file access or API token creation.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability exists in Wazuh versions from 4.0.0 to 4.14.6 and 5.0.0-beta3. The issue is fixed in versions 4.14.6 and 5.0.0-beta3. A cluster peer holding the shared Fernet key can use traversal or an absolute path to make the master return any readable file over the cluster channel.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.