CVE-2026-44252: Wazuh Manager dapi RBAC Bypass Allows Privilege Escalation
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API user with manager:read permission to retrieve the cluster key from the element in ossec.conf through GET /manager/configuration?raw=true. An attacker with network access to TCP port 1516 can use the disclosed Fernet key to impersonate a cluster worker and submit distributed API requests containing attacker-controlled rbacpermissions with rbacmode set to black. Because the master trusts the worker-supplied authorization context, the attacker can create users, assign administrator roles, access credentials and API tokens, modify configuration, and execute actions across agents. This issue is fixed in version 4.14.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuh Managerto a version that resolves this vulnerability.Fixed in 4.14.5 - Compensating control
Restrict network access to TCP port 1516 so only trusted clients/worker nodes can reach the Wazuh Manager (the disclosed Fernet key enables impersonation of a cluster worker via network access to this port).
- Operational
After upgrading to Wazuh Manager 4.14.5, assume attacker access may have allowed creation/modification of users, administrator role assignments, and access to credentials/API tokens; review the created/modified identities and rotate any potentially exposed credentials and API tokens.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Wazuh Manager deployments from 4.0.0 through 4.14.5 are affected when an attacker can authenticate as a low-privilege API user with manager:read permission and can reach TCP port 1516.
What does an attacker need to escalate privileges?
The attacker first needs a read-only API account with manager:read permission to retrieve the cluster key through the raw manager configuration endpoint. They also need network access to TCP port 1516 to impersonate a cluster worker and send distributed API requests with attacker-controlled authorization data.
What can an attacker do after successful exploitation?
The attacker can create users, assign administrator roles, access credentials and API tokens, modify configuration, and execute actions across agents.
What is the available fix?
Upgrade Wazuh Manager to version 4.14.5, which fixes the issue.