CVE-2026-61783 wazuh CVE debrief

Who should care

Defenders and security teams responsible for Wazuh deployments, particularly those with low-privilege user accounts, should assess exposure and apply the patch to prevent unauthorized access to sensitive configuration data.

Why it matters

CVE-2026-61783 allows low-privilege users to read cluster secrets in Wazuh versions 4.14.0-4.14.6. Defenders should verify exposure, apply the patch, and restrict configuration access.

• Verify exposure and apply patch to prevent unauthorized access to sensitive configuration data
• Restrict configuration access to prevent potential data breaches
• Monitor for suspicious activity related to configuration endpoint access
• Review and update RBAC rules to prevent unauthorized configuration changes

Technical summary

The mask_sensitive_config() decorator in Wazuh incorrectly disables masking of sensitive values when a user has a manager:update_config or cluster:update_config rule, even if the rule's effect is deny. This allows an authenticated low-privilege user to read the cluster secret by making a GET request to the configuration endpoint with raw=true. The issue is caused by the _has_update_permissions() gate treating a user as able to update the config if a manager:update_config or cluster:update_config rule exists, regardless of the rule's effect being allow or deny. A single authenticated GET request to the configuration endpoint with raw=true returns the verbatim ossec.conf XML with cluster.key in clear. This issue

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, focusing on securing configuration access and sensitive data handling.

Recommended defensive actions

• Verify if the system is affected by checking the version and applying the patch to version 4.14.7
• Restrict configuration access to sensitive data
• Monitor for suspicious activity related to configuration endpoint access
• Review and update RBAC rules to prevent unauthorized configuration changes
• Conduct a thorough review of existing configuration and access controls
• Implement additional monitoring for configuration endpoint access
• Document and track the patch application process for auditing purposes

Evidence notes

The vulnerability is caused by the mask_sensitive_config() decorator only applying masking when _has_update_permissions() returns false. However, this gate incorrectly treats a user as able to update the config if a manager:update_config or cluster:update_config rule exists, regardless of the rule's effect being allow or deny. A single authenticated GET request to the configuration endpoint with raw=true returns the verbatim ossec.conf XML with cluster.key in clear.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.