Key points
- The flaw affects Wazuh manager versions from 4.1.1 up to but not including 4.14.8.
- Attackers need the cluster key to exploit the vulnerability via DistributedAPI requests.
- Version 4.14.8 is the first version that does not contain this vulnerability.
Security operations teams using Wazuh manager should immediately verify their software versions. The platform contains a path traversal vulnerability present in versions 4.1.1 through those preceding 4.14.8. This defect allows malicious actors to write files to arbitrary locations on the system. The issue carries a CVSS score of 8.5, which classifies it as high severity. Version 4.14.8 resolves this issue.
In plain English
The vulnerability exists in three specific file upload functions within the Wazuh architecture. These functions handle lists, rules, and decoder files. An attacker who possesses the cluster key can craft special API requests. These requests include directory traversal sequences like "../" in the filename field. The system fails to validate these inputs correctly at the REST controller level. Consequently, the wazuh user can write files to any path the user has permissions for.
The background
This issue is tracked as CVE-2026-74043 in national vulnerability databases. The underlying weakness is identified as CWE-22, or path traversal. The flaw affects the wazuh-manager component of the Wazuh security platform. The vulnerability allows file manipulation if an attacker can guess valid paths. The exploit requires possession of the cluster key, which limits the initial attack surface to insiders or compromised nodes holding this credential.
What changes now
Teams should update their Wazuh manager installations to version 4.14.8 or later. This update addresses the path traversal vulnerability in the upload functions. Organizations should review which nodes hold the cluster key and restrict that access. Monitoring for unusual file creation events by the wazuh user is critical. Until the update is applied, exposure remains high for any cluster where the key has been compromised or is broadly distributed.
Who needs to act first
Teams usually prioritize systems with external network exposure or those holding sensitive data. Check whether your cluster nodes have internet access and restrict API endpoints immediately. Back up current configurations before making any network changes. Test isolation strategies in a non-production environment to ensure monitoring capabilities remain intact. Rotate cluster keys if there is any suspicion of compromise. Verify that only authorized personnel hold the necessary credentials for cluster management operations.
What to do and how to stay safe: Wazuh
- Audit all Wazuh manager installations to confirm versions are below 4.14.8.
- Restrict network access to the DistributedAPI endpoints to trusted internal subnets only.
- Monitor system logs for unexpected file writes by the wazuh user account.
- Rotate cluster keys if there is any evidence of unauthorized access or key leakage.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Wazuh versions are affected by this path traversal flaw?
Wazuh manager versions from 4.1.1 up to, but not including, 4.14.8 are affected.
Is there a patch available for CVE-2026-74043?
Version 4.14.8 is the first version that does not contain this vulnerability.
What credentials are needed to exploit this vulnerability?
Attackers must possess the cluster key to send the malicious DistributedAPI requests.
