Wazuh Critical Flaw Allows Cluster Workers to Overwrite Master Config Files

The National Vulnerability Database has published a record for a critical vulnerability in Wazuh that allows unauthorized file overwrites within cluster environments. CVE-2026-74040 carries a CVSS score of 9.4, indicating a critical severity rating. The flaw resides in the MasterHandler.process_files_from_worker component. Attackers who control a cluster worker node can leverage this weakness to overwrite protected files on the master node. This capability bypasses intended security controls and compromises the integrity of the central management server.

The vulnerability stems from incorrect permission assignment for critical resources, classified under CWE-862. Specifically, the MasterHandler fails to enforce extra_valid checks properly. An attacker can use a trailing-slash basename bypass to trick the system into accepting malicious file paths. This allows the overwriting of ossec.conf and agent.conf files. These configuration files are essential for the operation of the Wazuh security platform. Modifying them can alter system behavior and security policies.

Technical Context of the Vulnerability

The core issue lies in how the Wazuh manager handles file transfers from worker nodes. The MasterHandler.process_files_from_worker function is responsible for processing these files. However, it lacks sufficient validation mechanisms to prevent path traversal or file name manipulation. The trailing-slash basename bypass exploits this gap by manipulating the file name structure.

This allows the attacker to target specific protected files rather than just uploading new ones. The missing extra_valid enforcement means the system trusts the incoming file metadata too much. Consequently, the manager overwrites existing critical configurations with attacker-controlled content. This undermines the trust model of the cluster architecture.

Impact on Wazuh Deployments

The impact of this vulnerability is severe due to the privileged nature of the affected files. Overwriting ossec.conf and agent.conf allows an attacker to execute arbitrary code with root privileges. This remote code execution affects both the manager node and every connected agent. The scope extends across the entire Wazuh deployment, not just the compromised worker. Any Wazuh version from 3.9.0 before 4.14.8 is affected by this issue. Organizations running these older versions are exposed to potential full compromise of their security monitoring infrastructure. The ability to execute code as root on agents means an attacker can pivot to other systems.

What should you do?

Security teams should immediately audit their Wazuh cluster configurations for any unauthorized changes. Verify the integrity of ossec.conf and agent.conf files on all managers and agents. Monitor cluster logs for unusual file transfer activities from worker nodes. Check for any unexpected modifications to configuration files that could indicate exploitation. Ensure that network segmentation limits access to the Wazuh manager from untrusted sources. Review permissions on worker nodes to prevent unauthorized code execution. Investigate any anomalies in the behavior of managed agents that might suggest remote code execution.