CVE-2026-74044: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wazuh wazuh-manager
Wazuh wazuh-manager versions from 4.0.0 up to but not including 4.14.6 contain a path traversal vulnerability. This flaw allows authenticated cluster peers with a valid Fernet key to delete arbitrary directory contents by sending a specially crafted node name in the cluster hello payload. The vulnerability arises because the node name is not properly validated, enabling attackers to trigger the master's peer cleanup routine to remove files within directories writable by the wazuh user. The CVSS 4.0 score is 7.0, indicating a high severity vulnerability.
AI Analysis
Technical Summary
CVE-2026-74044 is a path traversal vulnerability in Wazuh wazuh-manager affecting versions >=4.0.0 and <4.14.6. Authenticated cluster peers possessing a valid Fernet key can exploit this vulnerability by supplying a traversal-shaped node name in the cluster hello payload. Due to insufficient validation of the node name, the master's peer cleanup routine can be tricked into deleting arbitrary directory contents within the Wazuh installation path writable by the wazuh user. This can lead to unauthorized deletion of files, impacting system integrity and availability.
Potential Impact
An attacker with valid cluster authentication credentials (Fernet key) can delete arbitrary files and directories writable by the wazuh user within the Wazuh installation path. This can disrupt cluster operations and potentially cause denial of service or data loss. The vulnerability requires high privileges (authenticated cluster peer) but does not require user interaction or network complexity beyond cluster communication.
Mitigation Recommendations
A fix is available in Wazuh version 4.14.6 and later. Users should upgrade to version 4.14.6 or newer to remediate this vulnerability. Until patched, restrict cluster peer access and ensure that only trusted nodes hold valid Fernet keys. Monitor for unusual cluster peer disconnections that could indicate exploitation attempts.
CVE-2026-74044: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wazuh wazuh-manager
Description
Wazuh wazuh-manager versions from 4.0.0 up to but not including 4.14.6 contain a path traversal vulnerability. This flaw allows authenticated cluster peers with a valid Fernet key to delete arbitrary directory contents by sending a specially crafted node name in the cluster hello payload. The vulnerability arises because the node name is not properly validated, enabling attackers to trigger the master's peer cleanup routine to remove files within directories writable by the wazuh user. The CVSS 4.0 score is 7.0, indicating a high severity vulnerability.
CVSS v4.0
Score 7.0high
Affected software
Wazuh
wazuh-manager
pkg:github/wazuh-managerRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-74044 is a path traversal vulnerability in Wazuh wazuh-manager affecting versions >=4.0.0 and <4.14.6. Authenticated cluster peers possessing a valid Fernet key can exploit this vulnerability by supplying a traversal-shaped node name in the cluster hello payload. Due to insufficient validation of the node name, the master's peer cleanup routine can be tricked into deleting arbitrary directory contents within the Wazuh installation path writable by the wazuh user. This can lead to unauthorized deletion of files, impacting system integrity and availability.
Potential Impact
An attacker with valid cluster authentication credentials (Fernet key) can delete arbitrary files and directories writable by the wazuh user within the Wazuh installation path. This can disrupt cluster operations and potentially cause denial of service or data loss. The vulnerability requires high privileges (authenticated cluster peer) but does not require user interaction or network complexity beyond cluster communication.
Mitigation Recommendations
A fix is available in Wazuh version 4.14.6 and later. Users should upgrade to version 4.14.6 or newer to remediate this vulnerability. Until patched, restrict cluster peer access and ensure that only trusted nodes hold valid Fernet keys. Monitor for unusual cluster peer disconnections that could indicate exploitation attempts.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-14T14:06:40.513Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a849b61c6e8be03328d7585
Added to database: 08/18/2026, 17:50:25 UTC
Last enriched: 10/02/2026, 15:51:42 UTC
Last updated: 10/03/2026, 02:46:06 UTC
Views: 84
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.