Overview

CVE-2026-61800 is a critical vulnerability in Wazuh, an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. This vulnerability affects Wazuh versions 4.4.0 through 4.14.6 and allows a party holding the cluster key to write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code execution as root. The vulnerability is fixed in version 4.14.7 and has a CVSS score of 9.1, indicating a high severity.

Understanding the Vulnerability / Threat

Root Cause Analysis

The root cause of CVE-2026-61800 is a design issue in the cluster file synchronization process of Wazuh. Specifically, the non-merged branch of the `update_master_files_in_worker()` function moves each staged file to a destination derived only from `safe_join()`, which confines the path to /var/ossec but never verifies that the file lands in the directory declared by its `cluster_item_key`. This oversight allows a peer to place files at attacker-chosen locations under /var/ossec, including paths that are executed as root. This vulnerability belongs to the CWE-22 category, which involves improper limitation of a pathname to a restricted directory.

Attack Surface & Vector

The attack surface of CVE-2026-61800 is the cluster file synchronization process in Wazuh. An attacker must hold the cluster key to exploit this vulnerability. The attack vector is network-adjacent, and the attacker must have high privileges (i.e., possession of the cluster key).

Exploitation Mechanics — Scenario Walkthrough

Scenario: Compromising a Wazuh Worker Node 1. Initial Position: The attacker has obtained the cluster key and has access to the Wazuh cluster. 2. Triggering the Flaw: The attacker crafts a malicious file synchronization request, using the cluster key to authenticate. The request includes a file path that is not properly sanitized, allowing the attacker to redirect the file to an arbitrary location under /var/ossec. 3. What Breaks: The `safe_join()` function fails to verify that the file lands in the directory declared by its `cluster_item_key`, allowing the attacker to bypass security checks and write to arbitrary locations. 4. Attacker's Prize: The attacker gains the ability to write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code execution as root. The attacker can then use this access to execute malicious code, escalate privileges, or move laterally within the network.

Real-World Impact

The impact of CVE-2026-61800 can be significant, as it allows an attacker to execute remote code as root on Wazuh worker nodes. This can lead to a range of malicious activities, including data theft, lateral movement, and deployment of ransomware or other types of malware.

Detection & Defense

Immediate Mitigations

To defend against CVE-2026-61800, Wazuh users should upgrade to version 4.14.7 or later. This patch fixes the vulnerability by properly validating file paths and ensuring that files are written to the correct locations.

Detection Strategies

Defenders can detect exploitation attempts by monitoring Wazuh logs for suspicious file synchronization activity. Specifically, they can look for requests that involve unusual or unexpected file paths. Additionally, defenders can use network intrusion detection systems (NIDS) to detect and block malicious traffic.

Long-Term Hardening

To prevent similar vulnerabilities in the future, Wazuh users should implement a defense-in-depth strategy that includes:
  • Regularly updating and patching Wazuh and other software
  • Implementing strict access controls and authentication mechanisms
  • Monitoring logs and network activity for suspicious behavior
  • Using a web application firewall (WAF) to block malicious traffic

Key Takeaways

* CVE-2026-61800 is a critical vulnerability in Wazuh that allows remote code execution as root. * The vulnerability affects Wazuh versions 4.4.0 through 4.14.6 and is fixed in version 4.14.7. * Defenders should upgrade to version 4.14.7 or later and monitor logs for suspicious activity. * Implementing a defense-in-depth strategy can help prevent similar vulnerabilities in the future.

Sources

* National Vulnerability Database (NVD) * Wazuh security advisory