Wazuh Cluster Workers Can Overwrite Config Files to Gain Root Access
A critical flaw in Wazuh allows compromised cluster workers to overwrite protected configuration files, enabling remote code execution with root privileges across the entire security infrastructure.
Key points
- Wazuh versions from 3.9.0 up to 4.14.8 contain an arbitrary file overwrite vulnerability.
- Attackers controlling a worker node can bypass validation checks to modify core configuration files.
- Successful exploitation grants root-level remote code execution on the manager and all connected agents.
The malicious code exploits a fundamental trust issue within the Wazuh cluster architecture, allowing a compromised worker node to rewrite protected configuration files on the master server. This capability enables an attacker to inject arbitrary commands that execute with root privileges, effectively compromising the entire security monitoring stack.
How it unfolded
- Researchers identified an arbitrary file overwrite vulnerability in Wazuh versions ranging from 3.9.0 to those preceding 4.14.8.
- The flaw resides in the MasterHandler.process_files_from_worker function, which fails to properly enforce validation on incoming file operations.
- Attackers exploit a trailing-slash basename bypass to circumvent existing protections, allowing them to target specific system files.
Who is affected
Organisations running Wazuh manager versions prior to 4.14.8 are directly exposed to this critical vulnerability. The flaw affects the core management layer, meaning any cluster worker that an adversary controls can initiate the attack. Because the compromised configuration files include ossec.conf and agent.conf, the impact extends beyond the manager node to every agent connected to the cluster.
The fix
The National Vulnerability Database rates CVE-2026-74040 as critical with a CVSS score of 9.4. The vulnerability is classified under CWE-862, indicating a failure to properly restrict operations on files. Affected systems are those running Wazuh wazuh-manager before version 4.14.8. The source material indicates that versions before 4.14.8 contain the vulnerability, implying that 4.14.8 is the version where the issue is addressed.
What analysts watch for
Teams usually monitor cluster communication channels for unexpected file modification requests originating from worker nodes. Analysts should examine logs for attempts to access protected configuration paths using unusual naming conventions or trailing slashes. Persistence mechanisms often involve altering agent configuration files to maintain access across the network. Security teams must verify that all file transfer operations between cluster components adhere to strict validation rules and that no unauthorised changes to ossec.conf or agent.conf have occurred.
What to do and how to stay safe: Wazuh
- Audit cluster worker nodes for signs of compromise or unauthorised access that could facilitate the initial breach.
- Review configuration file integrity on master servers to detect any recent or unexplained modifications to ossec.conf or agent.conf.
- Restrict network access between worker and master nodes to limit the potential for lateral movement and file manipulation.
- Monitor system logs for abnormal file write operations or privilege escalation attempts within the Wazuh management interface.
Step-by-step guide: Patch Management: Eight Questions Answered for Stability
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Wazuh versions are vulnerable to CVE-2026-74040?
Wazuh versions from 3.9.0 up to but not including 4.14.8 are affected by this arbitrary file overwrite vulnerability.
What is the severity rating for this vulnerability?
The National Vulnerability Database rates CVE-2026-74040 as critical with a CVSS score of 9.4.
How does an attacker exploit this flaw?
Attackers controlling a cluster worker use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite protected master files.
