Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge() in framework/wazuh/core/results.py trusts the sort_casting field in a cluster worker's JSON response. During a distributed API merge, attacker-controlled type names are resolved through Python builtins without an allowlist. A compromised worker can set sort_casting to exec and place Python source in affected_items, causing the master to execute the payload as root when responses from multiple nodes are merged. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-19T17:18:49.283Z",
  "pubdate": "2026-08-19T17:18:49.283Z",
  "executiveSummary": "Wazuh contains a critical remote code execution vulnerability residing in the distributed API merge functionality of the cluster management architecture. The flaw exists due to unsafe deserialization and arbitrary type resolution within the framework/wazuh/core/results.py component, specifically inside the AffectedItemsWazuhResult.merge() method.\nAn attacker who has successfully compromised a cluster worker node can leverage this weakness to inject malicious payloads via the sort_casting and affected_items fields in JSON responses. When the Wazuh master node aggregates and processes responses from multiple cluster nodes during a distributed API merge operation, it blindly trusts and evaluates the attacker-controlled type names using Python builtins without implementing an explicit allowlist.\nThis vulnerability allows a compromised worker to manipulate the master node into executing arbitrary Python source code with root privileges. The issue impacts Wazuh versions from 4.0.0 until 4.14.6 and includes 5.0.0-beta2. The risk implications are severe, resulting in total compromise of the Wazuh master node and potential cascade effects across the entire monitored infrastructure. Remediation requires upgrading the platform to version 4.14.6, 5.0.0-beta2, or subsequent secure releases.",
  "technicalDetails": "The vulnerability is rooted in the lack of strict type validation and the utilization of insecure dynamic resolution in framework/wazuh/core/results.py. During distributed API operations in a Wazuh cluster, the master node coordinates requests and gathers JSON responses from worker nodes.\nWithin the AffectedItemsWazuhResult.merge() function, the master processes the sort_casting field provided in the worker's JSON payload. Instead of validating against a strict cryptographic or predefined allowlist of permitted classes or transformation types, the application resolves attacker-supplied type names directly through Python builtins.\nAn attacker operating a compromised cluster worker node can construct a malicious JSON response where the sort_casting field is explicitly set to a dangerous execution primitive such as exec. Simultaneously, the attacker places arbitrary Python source code payloads within the affected_items structure.\nAs the Wazuh master node performs the distributed API merge operation, it iterates over the worker responses, reads the unvalidated sort_casting parameter, and maps the string to runtime behaviors. By supplying the exec directive alongside malicious code in affected_items, the master node evaluates and executes the embedded Python payload.\nBecause standard Wazuh daemons frequently operate with elevated privileges to manage system configurations and agent communications, the execution of arbitrary Python code by the master process results in immediate remote code execution with root privileges.\nThe affected component is the AffectedItemsWazuhResult.merge() function located in framework/wazuh/core/results.py. Affected versions span from 4.0.0 through 4.14.6 (excluding the patched release) and the 5.0.0-beta2 release. Exploitation prerequisites require an attacker to first compromise a cluster worker node to inject malicious JSON data into the internal cluster communication channel during distributed API merges."
}