CVE-2026-61802

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.14.0 through 4.14.6

Description A low-privilege API user can access the cleartext cluster key through a configuration endpoint that fails to redact sensitive information. While the REST API typically uses a masking control called mask sensitive config to hide fields like authd.pass and cluster.key from users without update-config permissions, the 'GET /cluster/local/config' endpoint does not implement this control. This endpoint, which uses the read config wrapper function, only requires cluster:read permissions. Consequently, accounts with readonly or cluster readonly roles can retrieve the actual cluster key. Since this key is used to authenticate and encrypt traffic between cluster nodes, its disclosure can facilitate remote code execution chains between cluster peers.

Recommendations Update to version 4.14. Restrict access to the 'GET /cluster/local/config' endpoint for users with readonly or cluster readonly roles until the update is applied.