Description

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a malicious node name and disconnect, triggering the master's peer cleanup routine to remove the contents of arbitrary directories within the Wazuh installation path writable by the wazuh user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T18:19:33.907Z",
  "pubdate": "2026-08-18T18:19:33.907Z",
  "executiveSummary": "Wazuh versions 4.0.0 prior to 4.14.6 contain a critical path traversal vulnerability within the cluster communication mechanism, specifically affecting authenticated cluster peers. The vulnerability allows an attacker holding a valid cluster Fernet key to delete arbitrary directory contents within the Wazuh installation path writable by the wazuh user. The core issue stems from a lack of input validation on node names supplied within the cluster hello payload. When a malicious peer supplies a traversal-shaped node name and subsequently disconnects, the master node's peer cleanup routine processes the malicious payload without sanitization, resulting in unauthorized file system deletion operations. The risk implication is high, as successful exploitation leads to loss of data and integrity compromise of the affected Wazuh installation. Exploitation requires valid cluster authentication credentials via the Fernet key mechanism, limiting the attack vector to actors with pre-existing cluster access or compromised keys.",
  "technicalDetails": "The vulnerability is classified as a path traversal flaw residing in the cluster management and peer cleanup routine of Wazuh versions 4.0.0 up to 4.14.6. The vulnerable component fails to validate or sanitize node names provided by cluster peers during the cluster hello payload exchange. Because input validation is absent, an attacker can embed directory traversal sequences (such as dot-dot-slash patterns) directly into the node name parameter.\nThe exploitation method relies on possession of a valid cluster Fernet key, which is required to participate in cluster communications and authenticate as a cluster peer. The attack flow initiates when the malicious actor crafts a specialized cluster hello payload containing a traversal-shaped node name and transmits it to the cluster master. Following this transmission, the attacker forcibly disconnects from the cluster.\nThe disconnection triggers the master node's automated peer cleanup routine. During this routine, the master attempts to clean up resources associated with the disconnecting node by referencing the supplied node name. Due to the lack of path sanitization, the traversal sequences in the node name are evaluated by the file system operations within the cleanup routine. This causes the master node to navigate outside the intended operational directory and delete the contents of arbitrary directories within the Wazuh installation path that are writable by the wazuh user.\nThe prerequisites for this attack include network access to the Wazuh cluster communication port and possession of a valid cluster Fernet key for authentication. The post-exploitation impact includes the localized destruction of critical configuration files, logs, or application data within the Wazuh installation boundary, contingent upon the file system permissions granted to the wazuh user."
}