CVE-2026-49441: Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of processfilesfromworker() in framework/wazuh/core/cluster/master.py trusts a peer-controlled filepath key from filesmetadata.json. The destination is joined to WAZUHPATH without proving that it remains inside the directory selected by clusteritemkey. A cluster peer holding the shared Fernet key can upload a crafted extra-valid archive and overwrite security-sensitive files such as /var/ossec/etc/ossec.conf. Replacing ossec.conf can configure root-executed commands and lead to code execution after a service reload. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.14.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.0.0-beta3
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must control a Wazuh cluster peer and possess the shared Fernet key. The vulnerable manager then accepts peer-controlled archive metadata that can direct writes to security-sensitive paths under WAZUH_PATH.
Which deployments are affected?
Wazuh Manager versions from 4.3.0 through 4.14.6, and 5.0.0-beta3, are affected in the non-merged branch of process_files_from_worker(). The issue is fixed in versions 4.14.6 and 5.0.0-beta3.
What is the practical impact of a successful exploit?
A malicious peer can overwrite files such as /var/ossec/etc/ossec.conf. Replacing that configuration can define commands executed as root, resulting in code execution after a service reload.