Wazuh: 17 Vulnerabilities Disclosed Together, Affecting Cluster and API Functions
A batch of 17 Wazuh vulnerabilities, including critical flaws in path handling and API security, were disclosed together on August 18-19, 2026.
Key findings
- 17 CVEs disclosed together for Wazuh between Aug 18-19, 2026, with Critical, High, and Medium severities.
- Vulnerabilities include path traversal, arbitrary file write, and DoS, affecting cluster and API components.
- Affected versions range up to 4.14.6/4.14.7 and 5.0.0-beta versions.
- Patches are available in Wazuh 4.14.7 and 5.0.0-beta3.
- Unauthenticated remote attackers can exploit CVE-2026-74038 for DoS via agent enrollment.
- API vulnerabilities like CVE-2026-41424 and CVE-2026-44256 impact user management and authentication.
On August 18-19, 2026, a significant batch of 17 vulnerabilities was disclosed for the Wazuh security platform. These vulnerabilities, spanning critical, high, and medium severity ratings, were disclosed by multiple sources within a 23-hour window, highlighting a concentrated disclosure event affecting various components of the Wazuh architecture. The vulnerabilities primarily stem from improper path handling, insufficient input validation, and insecure deserialization, potentially allowing for remote code execution, denial of service, and unauthorized access within Wazuh deployments.
Several vulnerabilities center on insecure path manipulation and file handling. CVE-2026-49441, a critical vulnerability, arises from trusting a peer-controlled file_path key in framework/wazuh/core/cluster/master.py, allowing potential arbitrary file writes. Similarly, CVE-2026-48162, also critical, involves joining an attacker-controlled tmp_file value to WAZUH_PATH without proper sanitization in framework/wazuh/core/cluster/dapi/dapi.py. CVE-2026-48024, another critical flaw, stems from constructing paths from peer-controlled values in framework/wazuh/core/cluster/cluster.py during synchronization. On the file deletion front, CVE-2026-74044, a medium severity path traversal vulnerability, allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name. CVE-2026-74038, a high severity path traversal flaw, permits unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name.
Other vulnerabilities impact the Wazuh API and authentication mechanisms. CVE-2026-41424, a high severity issue, involves an incorrect user context being passed in the PUT /security/users/{user_id} API endpoint, potentially allowing unauthorized user modifications. CVE-2026-44256, a medium severity flaw, involves improper handling of Basic authentication credentials before validation, potentially logging sensitive information. CVE-2026-44255, another medium severity vulnerability, describes a scenario where authentication checks are bypassed for non-existent usernames. CVE-2026-74039, a medium severity denial of service vulnerability, allows authenticated attackers to exhaust CPU resources by submitting deeply nested JSON structures to the authentication endpoint.
Denial of service vulnerabilities are also prevalent. CVE-2026-44253, a medium severity flaw, allows an authenticated cluster node to exhaust memory on the master node due to improper handling of string reception. CVE-2026-74046, a medium severity vulnerability, allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. CVE-2026-44254, a medium severity vulnerability, involves a stack buffer overflow in secure message handling that could lead to a denial of service.
The affected versions for most of these vulnerabilities range from older versions up to Wazuh 4.14.6 or 4.14.7, and in some cases, include beta versions of 5.0.0. The patches are available in Wazuh versions 4.14.7 and 5.0.0-beta3, indicating that users should update to these or later versions to mitigate the risks.
This concentrated disclosure event underscores the importance of timely patching and vigilant monitoring for Wazuh users. The breadth of affected components, from core cluster functions to API endpoints, necessitates a thorough review of security configurations and prompt application of updates to protect against potential exploitation. Users are advised to consult the official Wazuh advisories for detailed mitigation steps and specific version information.