CVE-2026-49441: Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of processfilesfromworker() in framework/wazuh/core/cluster/master.py trusts a peer-controlled filepath key from filesmetadata.json. The destination is joined to WAZUHPATH without proving that it remains inside the directory selected by clusteritemkey. A cluster peer holding the shared Fernet key can upload a crafted extra-valid archive and overwrite security-sensitive files such as /var/ossec/etc/ossec.conf. Replacing ossec.conf can configure root-executed commands and lead to code execution after a service reload. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 4.14.6 - Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 5.0.0-beta3 - Compensating control
Temporarily restrict cluster peer communications so that untrusted peers cannot upload crafted archives or control the peer metadata used by process_files_from_worker (framework/wazuh/core/cluster/master.py).
- Operational
After upgrading to 4.14.6 or 5.0.0-beta3, verify that security-sensitive files under the WAZUH_PATH (e.g., /var/ossec/etc/ossec.conf) have not been overwritten, and reload services only after confirming file integrity. If ossec.conf was replaced, rotate any impacted credentials and validate configuration.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must control a Wazuh cluster peer and possess the shared Fernet key. The vulnerable manager then accepts peer-controlled archive metadata that can direct writes to security-sensitive paths under WAZUH_PATH.
Which deployments are affected?
Wazuh Manager versions from 4.3.0 through 4.14.6, and 5.0.0-beta3, are affected in the non-merged branch of process_files_from_worker(). The issue is fixed in versions 4.14.6 and 5.0.0-beta3.
What is the practical impact of a successful exploit?
A malicious peer can overwrite files such as /var/ossec/etc/ossec.conf. Replacing that configuration can define commands executed as root, resulting in code execution after a service reload.