CVE-2026-48162: Wazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file path injection in Wazuh manager
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.sendtmpfile() in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmpfile value to WAZUHPATH without canonicalization or confinement. A cluster peer holding the shared Fernet key can use traversal or an absolute path to make the master return any readable file over the cluster channel. Reading /var/ossec/api/configuration/security/privatekey.pem allows the peer to forge administrator REST API tokens offline and then exercise administrative privileges without creating an account. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wazuhto a version that resolves this vulnerability.Fixed in 4.14.6 - Upgrade
Upgrade
wazuhto a version that resolves this vulnerability.Fixed in 5.0.0-beta3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Wazuh versions from 4.0.0 through 4.14.6, and 5.0.0-beta3, are identified as affected. Exploitation requires a cluster peer that possesses the shared Fernet key, so the exposed role is the cluster master receiving DistributedAPI temporary-file requests from such a peer.
What does an attacker need before they can exploit this?
The attacker needs to operate or compromise a Wazuh cluster peer and hold the cluster's shared Fernet key. No REST API account needs to be created if the attacker can retrieve the API private key and forge administrator tokens offline.
What is the practical impact after a malicious peer accesses the API private key?
A peer can request readable files from the master using traversal or an absolute tmp_file path. If it obtains /var/ossec/api/configuration/security/private_key.pem, it can forge administrator REST API tokens offline and use administrative privileges.
What versions contain the fix?
The issue is fixed in Wazuh 4.14.6 and 5.0.0-beta3.