CVE-2026-74033: Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the getlists() and deletelistfile() CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path, bypassing REST validation and RBAC to delete files like rbac.db.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Wazuh versions from 4.1.1 before 4.14.8 are affected. Exploitation targets the internal cluster RPC path and requires a compromised cluster worker.
What level of access does an attacker need?
The attacker needs control of a cluster worker with the ability to send requests over the internal cluster RPC path. The issue bypasses REST-layer validation and RBAC, so REST permissions do not prevent this attack path.
What can an attacker do through the vulnerable handlers?
A compromised worker can supply traversal or absolute-path filenames to read or delete files on the master. The advisory specifically notes that files such as rbac.db can be deleted.
What version resolves the vulnerability?
Upgrade to Wazuh 4.14.8 or later. Versions before 4.14.8 in the affected range should be treated as vulnerable.