Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.send_tmp_file() in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmp_file value to WAZUH_PATH without canonicalization or confinement. A cluster peer holding the shared Fernet key can use traversal or an absolute path to make the master return any readable file over the cluster channel. Reading /var/ossec/api/configuration/security/private_key.pem allows the peer to forge administrator REST API tokens offline and then exercise administrative privileges without creating an account. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-19T17:18:51.233Z",
  "pubdate": "2026-08-19T17:18:51.233Z",
  "executiveSummary": "A path traversal vulnerability exists in Wazuh affecting versions from 4.0.0 until 4.14.6 and 5.0.0-beta3. The vulnerability resides in the DistributedAPI.send_tmp_file() function located in framework/wazuh/core/cluster/dapi/dapi.py. It allows an attacker with access to a cluster peer holding the shared Fernet key to read arbitrary readable files on the master node without canonicalization or path confinement. Successful exploitation permits the retrieval of sensitive cryptographic assets, specifically the private key located at /var/ossec/api/configuration/security/private_key.pem. This compromises the integrity of the authentication architecture by enabling threat actors to forge administrator REST API tokens offline and subsequently execute administrative actions without provisioning a legitimate account. The issue requires access to the cluster communication channel and possession of the shared cluster secret for successful exploitation.",
  "technicalDetails": "The root cause of this vulnerability is the insecure handling of the attacker-controlled tmp_file parameter within the DistributedAPI.send_tmp_file() method in framework/wazuh/core/cluster/dapi/dapi.py. Specifically, the function concatenates the untrusted tmp_file input directly to the base WAZUH_PATH directory without implementing proper path canonicalization, normalization, or confinement checks. This lack of validation permits directory traversal sequences (such as dot-dot-slash) or absolute paths to be injected into the file retrieval mechanism.\nThe vulnerable component is the distributed application programming interface (dapi) cluster communication module in Wazuh. Affected versions include all deployments running software from version 4.0.0 up to 4.14.6, as well as version 5.0.0-beta3. Exploitation requires network exposure of the Wazuh cluster communication channel and authentication privileges in the form of holding the shared Fernet key utilized by cluster peers.\nThe step-by-step attack flow proceeds as follows: First, an attacker establishes unauthorized control over a cluster peer or leverages a compromised node that possesses the shared Fernet key. Second, the attacker invokes the distributed API request handling mechanism, supplying a crafted payload containing path traversal sequences or an absolute path within the tmp_file parameter. Third, the master node receives the request over the cluster channel and processes the unvalidated file path by appending it directly to WAZUH_PATH. Fourth, the master node reads the target file from the underlying filesystem and returns its contents across the cluster channel to the requesting peer.\nBy targeting this flaw, an adversary can request sensitive files such as /var/ossec/api/configuration/security/private_key.pem. Post-exploitation impact is critical; possession of the master's private key allows the adversary to perform offline cryptographic operations to forge valid administrator REST API tokens. These forged tokens grant complete administrative privileges over the Wazuh platform without requiring user account creation, bypassing standard authentication controls and facilitating persistent unauthorized management access."
}