Skip to content
OpenAdvisories
High WID-SEC-2026-3878 15 CVEs

Wazuh: Mehrere Schwachstellen

Published Oct 12, 2026 · Updated Oct 13, 2026 · Revision 2 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Wazuh ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.

Product

Wazuh ist eine Sicherheitsüberwachungsplattform, die Funktionen wie Intrusion Detection, Log-Analyse und Sicherheitsinformations- und Ereignismanagement (SIEM) bietet.

Vulnerabilities 15

  • Critical 9.1
    CVE-2026-74040

    Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker

    Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basenam…

    wazuh wazuh-manager
  • Critical 9.0
    CVE-2026-74043

    Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions

    Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send Distribut…

    wazuh wazuh-manager
  • High 7.5
    CVE-2026-74034 Public exploit

    Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command

    Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read a…

    wazuh wazuh-manager
  • High 7.2
    CVE-2026-74035

    Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user

    Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to …

    wazuh wazuh-manager
  • High 7.2
    CVE-2026-74036

    Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies

    Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/incoming via the upgrade c…

    wazuh wazuh-agent
  • High 7.2
    CVE-2026-74037

    Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token

    Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role…

    wazuh wazuh-manager
  • High 7.2
    CVE-2026-74041

    Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch

    Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT comma…

    wazuh wazuh-manager
  • High 7.1
    CVE-2026-74045

    Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder

    Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and determinist…

    wazuh wazuh-manager
  • Medium 6.5
    CVE-2026-74031

    Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers

    Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attackers holding the cluster…

    wazuh wazuh-manager
  • Medium 6.5
    CVE-2026-74047

    Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint

    Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Attackers holding the defa…

    wazuh wazuh-manager
  • Medium 6.1
    CVE-2026-74033

    Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers

    Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames …

    wazuh wazuh-manager
  • Medium 5.3
    CVE-2026-93346

    Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition

    Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max_login_attempts by sending concurrent requests. Attackers can fire concurrent login bursts to the authenticate and run_as endpo…

    wazuh wazuh-manager
  • Medium 4.9
    CVE-2026-74030

    Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion

    Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memory. Attackers controlling the manager can push a small SCA policy with nested aliases via…

    wazuh wazuh-manager wazuh-agent
  • Medium 4.9
    CVE-2026-93347

    Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file

    Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI request…

    wazuh wazuh-manager
  • Medium 4.3
    CVE-2026-74032

    Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions

    Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read the RBAC catalog by querying unprotected security endpoints. Attackers can request GET /security/actions and /security/resourc…

    wazuh wazuh-manager

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-98674, EUVD-2026-98679, EUVD-2026-98682, EUVD-2026-98681, EUVD-2026-98680, EUVD-2026-98678, EUVD-2026-98677, EUVD-2026-98675, EUVD-2026-98673, EUVD-2026-98672, EUVD-2026-98671, EUVD-2026-98670, EUVD-2026-98668, EUVD-2026-98669, EUVD-2026-98676

  2. #1

    Initiale Fassung

References