CVE-2026-74038: Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment
Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OSIsValidName() and unsafe path concatenation in deletediff() to resolve the traversal to the parent queue directory, causing its subdirectories to be removed and stopping all Wazuh services requiring manual recovery.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 4.14.6 - Operational
After the Wazuh upgrade, perform manual recovery to restore any Wazuh services that were stopped due to deletion of subdirectories in the parent queue directory.
Event History
Frequently Asked Questions
Which deployments are exposed?
Wazuh versions from 4.0.0 up to, but not including, 4.14.6 are affected. The vulnerable path is the agent enrollment port, so deployments that expose or permit access to that service are the relevant attack surface.
What does an attacker need to exploit this?
An attacker can exploit the issue remotely without authentication by enrolling an agent using a dot-sequence name such as "..". Exploitation requires user interaction, as reflected in the supplied attack vector.
What can be done while patching is delayed?
If immediate upgrading is not possible, restrict network access to the agent enrollment port to trusted hosts to prevent unauthenticated remote enrollment attempts. Manual recovery is required after successful exploitation because affected Wazuh services stop when queue subdirectories are removed.
How can administrators identify a possible compromise?
A successful attack removes subdirectories from the parent queue directory and stops Wazuh services that depend on them. Administrators should investigate unexpected removal of queue subdirectories and corresponding Wazuh service outages.