CVE-2026-74033 is a path traversal vulnerability in Wazuh wazuh-manager versions from 4.1.1 up to but not including 4.14.8. It affects the internal cluster RPC path handlers get_lists() and delete_list_file(), allowing compromised cluster workers to bypass REST validation and RBAC controls. This enables attackers to read or delete sensitive master files such as rbac.db. The vulnerability is fixed in version 4.14.8.
CVE-2026-74032 is an authorization bypass vulnerability in Wazuh wazuh-manager versions 4.0.0 through before 4.14.8. It allows low-privileged authenticated users to access unprotected security endpoints that expose the RBAC catalog. Specifically, attackers can query GET /security/actions and /security/resources endpoints, which do not enforce RBAC policies, enabling them to map privileged actions and endpoints. This information can be used to plan privilege escalation attacks. The vulnerability has a medium severity score of 5.3 and was fixed in version 4.14.8.
CVE-2026-74031 is a path traversal vulnerability in Wazuh wazuh-manager versions 4.1.1 through before 4.14.8. It allows malicious cluster workers with the cluster key to delete arbitrary files by exploiting unvalidated filename parameters in delete_rule_file and delete_decoder_file helpers. This can lead to deletion of critical configuration files such as ossec.conf, client.keys, or rules as the wazuh user. The vulnerability is fixed in version 4.14.8.
Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memory. Attackers controlling the manager can push a small SCA policy with nested aliases via merged.mg to OOM-kill wazuh-modulesd on every agent in a group.
CVE-2026-49392 is an improper input validation vulnerability in Wazuh affecting versions from 4.6.0 up to but not including 4.14.6, and from 5.0.0-beta1 up to but not including 5.0.0-beta3. The flaw arises from unsafe concatenation of monitored file paths into SQLite queries without proper escaping on non-Windows systems, allowing a local user to inject SQL UNION SELECT expressions via crafted filenames in the File Integrity Monitoring directories. This can manipulate SELECT result sets used by the File Integrity Monitoring code. The issue is fixed in versions 4.14.6 and 5.0.0-beta3.
CVE-2026-44256 is a vulnerability in Wazuh versions from 4.4.0 up to but not including 4.14.6, and from 5.0.0-beta1 up to but not including 5.0.0-beta2. It involves improper output neutralization for logs (CWE-117) where the Basic authentication username is decoded and logged without sanitizing control characters. This allows an unauthenticated attacker to inject carriage returns or line feeds into the username, potentially forging log entries, obscuring activity, or poisoning systems that consume the plain-text audit log. The JSON log format is not affected. The issue is fixed in versions 4.14.6 and 5.0.0-beta2.
CVE-2026-45798 is a high-severity stack-based buffer overflow vulnerability in Wazuh versions from 4.5.0 up to but not including 4.14.6, and from 5.0.0-beta1 up to but not including 5.0.0-beta2. The flaw exists in the compare_wazuh_versions() function, which improperly handles an attacker-controlled version string during anonymous TLS enrollment via wazuh-authd on TCP port 1515. This can lead to a remote denial of service by causing out-of-bounds reads and writes on the stack. The issue is fixed in versions 4.14.6 and 5.0.0-beta2.
CVE-2026-49441 is a critical vulnerability in Wazuh versions from 4.3.0 up to but not including 4.14.6, and from 5.0.0-beta1 up to but not including 5.0.0-beta3. It involves improper validation of a peer-controlled file path in the cluster master component, allowing a cluster peer with the shared Fernet key to upload crafted archives that overwrite sensitive files such as ossec.conf. This can lead to arbitrary code execution after a service reload. The issue is fixed in versions 4.14.6 and 5.0.0-beta3.
CVE-2026-41424 is an incorrect authorization vulnerability in Wazuh versions from 4.9.0 up to but not including 4.10.4, and from 4.11.0 up to but not including 4.14.6. It allows an authenticated user with the users_admin role to overwrite passwords of protected administrator accounts, including the superuser, by exploiting improper user identity verification in the API. This flaw is fixed in versions 4.10.4 and 4.14.6.
CVE-2026-44255 is a timing discrepancy vulnerability in Wazuh's authentication mechanism. Versions from 4.0.0 up to but not including 4.14.6, and 5.0.0-beta1 up to but not including 5.0.0-beta2, perform an expensive bcrypt password hash check only when the username exists, causing different response times for valid and invalid usernames. This allows unauthenticated remote attackers to enumerate valid usernames by measuring authentication response times. The issue is fixed in versions 4.14.6 and 5.0.0-beta2.
CVE-2026-48024 is a critical path traversal vulnerability in Wazuh versions from 4.0.0 up to but not including 4.14.6, and from 5.0.0-beta1 up to but not including 5.0.0-beta3. It allows a cluster peer with the shared Fernet key to write arbitrary files outside the intended directory, including sensitive configuration files like ossec.conf. This can lead to remote code execution when Wazuh services reload. The issue is fixed in versions 4.14.6 and 5.0.0-beta3.
CVE-2026-48162 is a critical vulnerability in Wazuh versions from 4.0.0 up to but not including 4.14.6, and from 5.0.0-beta1 up to but not including 5.0.0-beta3. The flaw exists in the DistributedAPI.send_tmp_file() function, which improperly handles an attacker-controlled file path without canonicalization or confinement. This allows a cluster peer with the shared Fernet key to perform path traversal or use absolute paths to read arbitrary files on the master node. Exploiting this, an attacker can read the private_key.pem file, enabling offline forging of administrator REST API tokens and gaining administrative privileges without an account. The issue is fixed in versions 4.14.6 and 5.0.0-beta3.
CVE-2026-44901 is a deserialization vulnerability in Wazuh versions from 4.0.0 up to but not including 4.14.6, and from 5.0.0-beta1 up to but not including 5.0.0-beta2. The flaw exists in the AffectedItemsWazuhResult.merge() function, which improperly trusts the sort_casting field in a cluster worker's JSON response. This allows a compromised worker to execute arbitrary Python code as root on the master node during distributed API merges. The issue is fixed in versions 4.14.6 and 5.0.0-beta2.
CVE-2026-44254 is a medium severity vulnerability in Wazuh affecting versions from 1.0.0 up to but not including 4.14.6 and from 5.0.0-beta1 up to but not including 5.0.0-beta2. It involves an incorrect calculation of buffer size in the remoted daemon component, leading to a stack out-of-bounds write when processing certain encrypted agent messages. This can cause crashes and disrupt agent communications. The issue is fixed in versions 4.14.6 and 5.0.0-beta2.
CVE-2026-46343 is a path traversal vulnerability in Wazuh versions from 4.0.0 up to but not including 4.14.6 and from 5.0.0-beta1 up to but not including 5.0.0-beta2. It allows a cluster-authenticated node to delete arbitrary files outside the intended directory by exploiting improper handling of file paths in the end_receiving_file() function. This can lead to deletion of critical configuration and secret files, potentially disabling the manager and disrupting cluster and API operations. The issue is fixed in versions 4.14.6 and 5.0.0-beta2.
CVE-2026-44253 is a medium severity vulnerability in Wazuh versions from 3.9.0 up to but not including 4.14.5 and from 5.0.0-beta1 up to but not including 5.0.0-beta2. It allows an authenticated cluster node to cause memory exhaustion on the master node by sending specially crafted requests that allocate excessive memory without limits. This can disrupt agent connectivity and alert processing. The issue is fixed in Wazuh versions 4.14.5 and 5.0.0-beta2.
Wazuh Manager versions from 4.0.0 up to but not including 4.14.5 contain an authorization vulnerability allowing a low-privilege read-only API user to retrieve the cluster key. This key can be used to impersonate a cluster worker and escalate privileges to perform administrative actions. The issue is fixed in version 4.14.5.
Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster Fernet key can upload a small, highly compressed zip bomb archive that forces wazuh-clusterd on the master node to decompress the full payload into memory, causing memory exhaustion and service disruption.
Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a malicious node name and disconnect, triggering the master's peer cleanup routine to remove the contents of arbitrary directories within the Wazuh installation path writable by the wazuh user.
Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow_run_as enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/run_as endpoint. Attackers can repeatedly submit malformed auth_context bodies with unlimited nesting depth to cause the API framework to consume excessive CPU, denying service to all other API consumers.