CVE-2026-48162

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.5 Wazuh versions 5.0.0-beta1 through 5.0.0-beta2

Description The DistributedAPI.send tmp file() function in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmp file value to WAZUH PATH without canonicalization or confinement. A cluster peer possessing the shared Fernet key can utilize path traversal or an absolute path to force the master to return any readable file via the cluster channel. For instance, accessing /var/ossec/api/configuration/security/private key.pem enables a peer to forge administrator REST API tokens offline and exercise administrative privileges without an account.

Recommendations Update to version 4.14.6. Update to version 5.0.0-beta3.