Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of process_files_from_worker() in framework/wazuh/core/cluster/master.py trusts a peer-controlled file_path key from files_metadata.json. The destination is joined to WAZUH_PATH without proving that it remains inside the directory selected by cluster_item_key. A cluster peer holding the shared Fernet key can upload a crafted extra-valid archive and overwrite security-sensitive files such as /var/ossec/etc/ossec.conf. Replacing ossec.conf can configure root-executed commands and lead to code execution after a service reload. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
Warning: Critical #vulnerabilities in #Wazuh! CVE-2026-49441, CVE-2026-48024, CVE-2026-48162 (CVSS 9.1). Cluster peers can overwrite configs or forge admin tokens, risking code execution with root privileges! Time to #Patch #Patch #Patch
Post summary
The tweet warns of three critical CVEs in Wazuh (CVSS 9.1), detailing config overwrite and token forging that could lead to root‑level code execution, and urges users to apply patches.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wazuh | wazuh | - | - | - |
| App | wazuh | wazuh | 5.0.0 | - | - |
| App | wazuh | wazuh | 5.0.0 | - | - |