CVE-2026-44901: Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge() in framework/wazuh/core/results.py trusts the sortcasting field in a cluster worker's JSON response. During a distributed API merge, attacker-controlled type names are resolved through Python builtins without an allowlist. A compromised worker can set sortcasting to exec and place Python source in affecteditems, causing the master to execute the payload as root when responses from multiple nodes are merged. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 4.14.6 - Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 5.0.0-beta2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Wazuh versions from 4.0.0 through 4.14.6, as well as 5.0.0-beta2, are identified as affected. Exploitation occurs on a Wazuh cluster master when it merges distributed API responses from multiple nodes.
What level of access does an attacker need to exploit this vulnerability?
The attacker needs control of a Wazuh cluster worker, allowing them to send a crafted JSON response to the master. They can set sort_casting to exec and supply Python source code through affected_items.
What is the impact if exploitation succeeds?
The cluster master executes the supplied payload as root. This can result in complete compromise of confidentiality, integrity, and availability on the master.
What remediation is available?
Upgrade to a fixed Wazuh release: 4.14.6 or 5.0.0-beta2. The fix prevents untrusted type names in cluster worker responses from being resolved through Python builtins.