VYPR
← All advisories
High severity8.4NVD Advisory· Published Aug 19, 2026· Updated Sep 15, 2026

CVE-2026-44901

CVE-2026-44901

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge() in framework/wazuh/core/results.py trusts the sort_casting field in a cluster worker's JSON response. During a distributed API merge, attacker-controlled type names are resolved through Python builtins without an allowlist. A compromised worker can set sort_casting to exec and place Python source in affected_items, causing the master to execute the payload as root when responses from multiple nodes are merged. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Wazuh/Wazuh4 versions
    cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*range: >=4.0.0,<4.14.6
    • cpe:2.3:a:wazuh:wazuh:5.0.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:wazuh:wazuh:5.0.0:beta2:*:*:*:*:*:*
    • (no CPE)range: 4.0.0 <= v < 4.14.6, 5.0.0-beta2

Patches

Vulnerability mechanics

References

5

News mentions

1