CVE-2026-74044

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.5

Description An issue exists where authenticated cluster peers can delete arbitrary directory contents within the installation path writable by the wazuh user. This occurs because the system fails to validate the node name provided in the cluster hello payload. An attacker possessing a valid cluster Fernet key can provide a traversal-shaped node name and then disconnect, which triggers the master's peer cleanup routine to remove the specified directories. Path traversal is a technique used to access files or directories outside the intended folder by using special characters like dot-dot-slash.

Recommendations Update Wazuh to version 4.14.6 or later.