Wazuh Cluster Vulnerability Allows Remote Code Execution on Worker Nodes

Security researchers have identified a critical remote code execution vulnerability within the Wazuh security monitoring platform. The flaw, designated CVE-2026-44901, resides in the cluster's Distributed API (DAPI) protocol and could allow attackers to compromise worker nodes.

The vulnerability stems from improper validation of user-supplied data within the sort_casting field of the DAPI protocol. This lack of validation permits the deserialization of untrusted data, which an attacker can exploit to execute arbitrary code. Successful exploitation requires the attacker to first gain low-privileged code execution capabilities on a target worker node.

Once initial access is achieved, the attacker can leverage this deserialization flaw to execute commands with root privileges on the master node. This escalation path presents a significant risk, as it allows for the compromise of the entire Wazuh cluster's management capabilities and potentially the data it collects.

The vulnerability carries a high CVSS score of 9.9, classifying it as critical. This severity rating underscores the urgent need for organizations using Wazuh to apply the available patches and mitigations. The potential impact includes complete system compromise, data exfiltration, and disruption of security monitoring operations.

Wazuh, a popular open-source security monitoring solution, is widely used by organizations to detect and respond to security threats. Its distributed architecture, while powerful, can also present a larger attack surface if not properly secured.

The vendor, Wazuh, has released an update to address this critical vulnerability. Users are strongly advised to update their Wazuh installations to the latest version to protect against potential exploitation. The advisory can be found on GitHub at https://github.com/wazuh/wazuh/security/advisories/GHSA-8c6v-7g3w-prrq.

The disclosure timeline indicates that the vulnerability was reported to the vendor on April 17, 2026, with a coordinated public release of the advisory on August 11, 2026. This coordinated disclosure process aims to give users sufficient time to patch their systems before the vulnerability becomes widely known and exploited.

This discovery highlights the ongoing challenges in securing complex distributed systems and the importance of diligent security practices, including regular patching and vulnerability management, for all software deployments.

This advisory details a critical remote code execution vulnerability (CVE-2026-28220) within Wazuh's cluster DAPI protocol, distinct from the previously reported CVE-2026-44901. While the prior report focused on RCE on worker nodes, this new vulnerability allows attackers to achieve arbitrary code execution on the master node by exploiting a deserialization flaw in the as_wazuh_object deserializer after gaining low-privileged code execution on a worker node. The CVSS score for this new vulnerability is 9.9.