CVE-2026-74040: Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker
Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.processfilesfromworker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extravalid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager and every agent.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 4.14.8
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must control a Wazuh cluster worker. The vulnerable handler allows that worker to overwrite protected files on the master.
What is the potential impact if exploitation succeeds?
The attacker can overwrite ossec.conf and agent.conf, leading to root remote code execution on the manager and across every agent.
Which deployments are affected?
Wazuh versions from 3.9.0 through versions before 4.14.8 are affected. Clustered deployments with workers are exposed to the described attack path.
What version resolves the vulnerability?
Wazuh 4.14.8 is identified as the fixed release. Upgrade affected installations to 4.14.8 or later.