CVE-2026-49441 wazuh CVE debrief

Who should care

Wazuh users and administrators, security teams, and IT professionals responsible for threat prevention, detection, and response. These stakeholders should assess exposure, prioritize remediation, and verify the integrity of the ossec.conf file to prevent potential code execution and configuration changes via ossec.conf replacement.

Why it matters

CVE-2026-49441 is a critical vulnerability in Wazuh that allows potential code execution via crafted archive upload. Wazuh users and administrators should assess exposure, prioritize remediation, and verify the integrity of the ossec.conf file.

• Potential code execution after a service reload
• Overwrite of security-sensitive files
• Configuration changes via ossec.conf replacement
• Possible privilege escalation via root-executed commands

Technical summary

The vulnerability is caused by the non-merged branch of process_files_from_worker() in framework/wazuh/core/cluster/master.py trusting a peer-controlled file_path key from files_metadata.json. This allows a cluster peer holding the shared Fernet key to upload a crafted extra-valid archive and overwrite security-sensitive files such as /var/ossec/etc/ossec.conf. An attacker can exploit this vulnerability by uploading a crafted archive to overwrite security-sensitive files, potentially leading to code execution after a service reload. Wazuh users and administrators should assess exposure, prioritize remediation, and verify the integrity of the ossec.conf file.

Defensive priority

High

Recommended defensive actions

• Upgrade to Wazuh version 4.14.6 or 5.0.0-beta3
• Restrict access to the Wazuh cluster
• Monitor for suspicious activity
• Verify the integrity of the ossec.conf file
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by the non-merged branch of process_files_from_worker() in framework/wazuh/core/cluster/master.py trusting a peer-controlled file_path key from files_metadata.json. This allows a cluster peer holding the shared Fernet key to upload a crafted extra-valid archive and overwrite security-sensitive files such as /var/ossec/etc/ossec.conf.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.