CVE-2026-49441

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.3.0 through 4.14.5 Wazuh versions 5.0.0-beta1 through 5.0.0-beta2

Description The process files from worker() function in framework/wazuh/core/cluster/master.py trusts a peer-controlled file path key from files metadata.json. The destination is joined to WAZUH PATH without verifying that it remains within the directory selected by cluster item key. A cluster peer possessing the shared Fernet key can upload a crafted archive to overwrite security-sensitive files, such as /var/ossec/etc/ossec.conf. Modifying ossec.conf allows the configuration of root-executed commands, which can lead to remote code execution after a service reload.

Recommendations Update to version 4.14.6. Update to version 5.0.0-beta3.