CVE-2026-61783 wazuh CVE debrief

Who should care

Defenders managing Wazuh instances, particularly those with low-privilege user accounts, should assess exposure and prioritize remediation. This includes reviewing current configurations, verifying the presence of explicit deny rules, and ensuring that all instances are upgraded to version 4.14.7. Additionally, defenders should monitor for suspicious activity and implement compensating controls where necessary.

Why it matters

CVE-2026-61783 allows authenticated low-privilege users to read cluster secrets in Wazuh versions 4.14.0-4.14.6. Defenders managing Wazuh should verify exposure and prioritize remediation by upgrading to version 4.14.7. The issue arises from a masking logic bypass due to RBAC rule interpretation.

• An authenticated low-privilege user can access sensitive cluster secrets.
• Masking logic is bypassed due to RBAC rule interpretation.
• Verification of Wazuh instance exposure is required.
• Remediation involves upgrading to version 4.14.7.

Technical summary

In Wazuh versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration. The issue arises because the logic that masks sensitive values is disabled by any update-config RBAC rule, including an explicit deny. This allows a read-only account with an explicit deny rule to be treated as having update permission, which turns off masking. A single authenticated GET request to the configuration endpoint with 'raw=true' returns the verbatim ossec.conf XML with 'cluster.key' in clear.

Defensive priority

Defenders should prioritize verifying exposure and remediating vulnerable Wazuh instances.

Recommended defensive actions

• Verify Wazuh instance exposure and upgrade to version 4.14.7 if vulnerable.
• Restrict access to configuration endpoints.
• Monitor for suspicious configuration access.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Evidence from Wazuh and NVD indicates an authenticated low-privilege user can read cluster secrets due to a masking logic bypass. The issue arises from the misinterpretation of RBAC rules, specifically when an explicit deny rule is present. This allows sensitive information, such as the 'cluster.key', to be exposed in the ossec.conf XML when a GET request is made with 'raw=true'. The fix involves updating to version 4.14.7, which correctly handles masking logic. Defenders should verify exposure and prioritize remediation by assessing

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.