Skip to content
OpenAdvisories
High WID-SEC-2026-2883 13 CVEs

Wazuh: Mehrere Schwachstellen

Published Aug 17, 2026 · Updated Nov 4, 2026 · Revision 5 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Wazuh ausnutzen, um Dateien zu manipulieren, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um einen SQL-Injection Angriff durchzuführen, und um beliebigen Programmcode auszuführen.

Product

Wazuh ist eine Sicherheitsüberwachungsplattform, die Funktionen wie Intrusion Detection, Log-Analyse und Sicherheitsinformations- und Ereignismanagement (SIEM) bietet.

Vulnerabilities 13

  • Critical 9.1
    CVE-2026-61800

    Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)

    Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker…

    wazuh wazuh
  • High 8.1
    CVE-2026-54083

    Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion

    Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The  ip-customblock  active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files o…

    wazuh wazuh
  • High 7.5
    CVE-2026-71540

    Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion

    Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.9.0 until 4.14.7, wazuh-clusterd in framework/wazuh/core/cluster/common.py allocates a payload buffer using the size declared in a 20…

    wazuh wazuh
  • High 7.1
    CVE-2026-54085

    Wazuh: Missing input validation in multiple active response scripts allows argument injection

    Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands witho…

    wazuh wazuh
  • High 7.1
    CVE-2026-74038

    Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment

    Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient v…

    wazuh wazuh-manager
  • High 7.0
    CVE-2026-61783

    Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key

    Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because th…

    wazuh wazuh
  • Medium 6.5
    CVE-2026-61802

    Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config

    Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to r…

    wazuh wazuh
  • Medium 6.5
    CVE-2026-61811

    Wazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion

    Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.8.0 until 4.14.7, the _getattributes() function in src/os_xml/os_xml.c recursively processes every XML attribute without a depth limi…

    wazuh wazuh
  • Medium 6.5
    CVE-2026-74039

    Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context

    Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow_run_as enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authe…

    wazuh wazuh-manager
  • Medium 6.5
    CVE-2026-74044

    Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello

    Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a val…

    wazuh wazuh-manager
  • Medium 5.3
    CVE-2026-54084

    Wazuh agent enrollment NULL pointer dereference via malformed manager response

    Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or man-in-the-middle enrollment manager can crash a Wazuh agent during enrollment by returning…

    wazuh wazuh
  • Medium 5.3
    CVE-2026-62365

    Wazuh: Heap Buffer Overflow in DecodeWinevt() join_data Accumulation via Crafted EventChannel XML

    Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents into the fixed 65,535-…

    wazuh wazuh
  • Medium 4.9
    CVE-2026-74046

    Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb

    Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size lim…

    wazuh wazuh-manager

Revision history

  1. #5

    Referenz(en) aufgenommen: EUVD-2026-117190

  2. #4

    Referenz(en) aufgenommen: EUVD-2026-86333, EUVD-2026-86331

  3. #3

    Referenz(en) aufgenommen: EUVD-2026-67340, EUVD-2026-67308, EUVD-2026-67307, EUVD-2026-67304, EUVD-2026-67303, EUVD-2026-67358

  4. #2

    Referenz(en) aufgenommen: EUVD-2026-61075, EUVD-2026-61074, EUVD-2026-61077, EUVD-2026-61076

  5. #1

    Initiale Fassung

References