Wazuh: Six Vulnerabilities Disclosed, Including Critical RCE and Path Traversal
Six vulnerabilities in the Wazuh security platform, disclosed August 28, 2026, range from Medium to Critical, with one allowing remote code execution.
Key findings
- Six Wazuh vulnerabilities disclosed on August 28, 2026, affecting versions 4.0.0 through 4.14.6.
- Critical CVE-2026-61800 allows remote code execution as root via cluster key compromise.
- High severity flaws include path traversal (CVE-2026-54083) and argument injection (CVE-2026-54085).
- Medium severity issues involve cleartext cluster key exposure (CVE-2026-61802) and agent crashes (CVE-2026-54084).
- All vulnerabilities patched in versions subsequent to 4.14.6; immediate update recommended.
On August 28, 2026, a batch of six vulnerabilities was disclosed for the Wazuh security platform, spanning versions 4.0.0 through 4.14.6. This coordinated disclosure event, occurring within a two-hour window, highlights several critical security weaknesses within the open-source XDR and SIEM solution. The vulnerabilities range in severity from Medium to Critical, with the most severe allowing for remote code execution as root.
Several vulnerabilities stem from improper handling of sensitive information and script sanitization. CVE-2026-61802, a Medium severity flaw, allows a low-privilege API user to read the cleartext cluster key due to a failure in redacting it from a configuration endpoint. Similarly, CVE-2026-61783, rated High, permits an authenticated low-privilege user to access the cluster secret from the manager configuration because sensitive value masking logic is bypassed during updates.
A critical vulnerability, CVE-2026-61800 (Critical, CVSSv3 9.1), arises when a party possessing the cluster key can manipulate files on worker nodes, leading to remote code execution as root. This is facilitated by the ability to write, overwrite, or delete arbitrary files under /var/ossec.
Further complicating the security posture, CVE-2026-54085 (High, CVSSv3 7.1) involves multiple active response scripts that pass attacker-influenced alert fields to privileged system commands without proper validation. This allows for argument injection, potentially leading to command execution. Another High severity vulnerability, CVE-2026-54083, is present in the ip-customblock active response script. It contains a path traversal flaw, enabling an attacker to create or delete arbitrary files as root by manipulating the script's file path construction.
Finally, CVE-2026-54084, a Medium severity vulnerability (CVSSv3 5.3), affects the Wazuh agent enrollment process. A malicious or man-in-the-middle enrollment manager can cause a Wazuh agent to crash during enrollment by providing a malformed key response with fewer than the expected four fields.
All disclosed vulnerabilities affect Wazuh versions ranging from 4.0.0 to 4.14.6. Users are strongly advised to update to a patched version as soon as possible to mitigate the risks associated with these security flaws. The wide range of affected versions underscores the importance of timely patching for all Wazuh deployments.
The timely disclosure of these six vulnerabilities within a short timeframe emphasizes the need for continuous security monitoring and prompt patching of the Wazuh platform. The potential for remote code execution and arbitrary file manipulation highlights the critical nature of these issues for organizations relying on Wazuh for their security infrastructure. Users should prioritize updating their Wazuh deployments to secure versions to prevent exploitation.