CVE-2026-48162

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.send_tmp_file() in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmp_file value to WAZUH_PATH without canonicalization or confinement. A cluster peer holding the shared Fernet key can use traversal or an absolute path to make the master return any readable file over the cluster channel. Reading /var/ossec/api/configuration/security/private_key.pem allows the peer to forge administrator REST API tokens offline and then exercise administrative privileges without creating an account. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.

• CWE-73

• https://github.com/wazuh/wazuh/commit/de1eeedbe336744934be4e20d87d84a76e438ceePatch
• https://github.com/wazuh/wazuh/pull/36246Issue Tracking, Patch
• https://github.com/wazuh/wazuh/releases/tag/v4.14.6Patch, Release Notes
• https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta3Patch, Release Notes
• https://github.com/wazuh/wazuh/security/advisories/GHSA-r6f5-h662-8ffcExploit, Vendor Advisory
• https://github.com/wazuh/wazuh/security/advisories/GHSA-r6f5-h662-8ffcExploit, Vendor Advisory

Published

Aug 19, 2026

Last Modified

Sep 15, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48157Slim is a PHP micro framework that enables users to write si…6.1
• CVE-2026-48158use-context-selector is a React useContextSelector hook in u…9.3
• CVE-2026-48159use-reducer-async is a React useReducer with async actions. …9.3
• CVE-2026-4816A Reflected Cross Site Scripting (XSS) vulnerability has bee…5.4
• CVE-2026-48160react-tracked provides state usage tracking with Proxies. Be…9.3
• CVE-2026-48161react18-use is a React 19 use hook shim. Between 2026-05-19 …9.3
• CVE-2026-48163MariaDB server is a community developed fork of MySQL server…7.2
• CVE-2026-48165MariaDB server is a community developed fork of MySQL server…7.2
• CVE-2026-48166Filament is a collection of full-stack components for accele…5.3
• CVE-2026-48167Filament is a collection of full-stack components for accele…6.4
• CVE-2026-48168PraisonAI is a multi-agent teams system. In versions prior t…10
• CVE-2026-48169PraisonAI is a multi-agent teams system. Versions prior to 0…8.8