CVE-2026-61783: Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is disabled by any update-config RBAC rule, including an explicit deny. The masksensitiveconfig() decorator applies masking only when hasupdatepermissions() returns false, but that gate treats a user as able to update the config whenever a manager:updateconfig or cluster:updateconfig rule exists, without ever checking whether the rule's effect is allow or deny. Because a deny rule is stored as a real entry, a read-only account that is hardened by explicitly denying config edits is counted as having update permission, which turns masking off. A single authenticated GET request to the configuration endpoint with raw=true then returns the verbatim ossec.conf XML with cluster.key in clear, whereas an otherwise identical account without the deny rule sees the value masked. This issue is fixed in version 4.14.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 4.14.7
Event History
Frequently Asked Questions
Which deployments and accounts are exposed?
Wazuh versions 4.14.0 through 4.14.6 are affected when an authenticated low-privilege account has a manager:update_config or cluster:update_config RBAC rule present with an explicit deny effect. Read-only accounts without that deny rule continue to receive masked sensitive configuration values.
What does an attacker need to retrieve the secret?
The attacker needs valid authentication to a qualifying low-privilege account and must send a GET request to the configuration endpoint with raw=true. The response can contain the ossec.conf XML with cluster.key in clear text.
How can administrators determine whether they may already be affected?
Review RBAC assignments for low-privilege or read-only users that explicitly deny manager:update_config or cluster:update_config. For those accounts on affected versions, a raw configuration GET returning an unmasked cluster.key indicates exposure.
What is the available remediation?
Upgrade Wazuh to version 4.14.7, which fixes the permission-effect check. If upgrading is not immediately possible, avoid assigning explicit deny rules for the affected update-config permissions to accounts that should only read configuration, and restrict access to the raw configuration endpoint.