CVE-2026-61783

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.14.0 through 4.14.6

Description An authenticated low-privilege user can read the cluster secret from the manager configuration. This occurs because the logic used to mask sensitive values is disabled whenever any update-config Role-Based Access Control (RBAC) rule exists, regardless of whether the rule is set to allow or deny. Specifically, the mask sensitive config() decorator only applies masking if the has update permissions() function returns false. However, has update permissions() considers a user to have update permissions if a manager:update config or cluster:update config rule is present, failing to verify the rule's actual effect. Consequently, an account explicitly denied configuration edits is incorrectly treated as having update permissions, disabling the masking. An authenticated GET request to the configuration endpoint using the raw=true parameter can then return the ossec.conf XML file containing the cluster.key in clear text.

Recommendations Update to version 4.14.7.