CVE-2026-49441

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of process_files_from_worker() in framework/wazuh/core/cluster/master.py trusts a peer-controlled file_path key from files_metadata.json. The destination is joined to WAZUH_PATH without proving that it remains inside the directory selected by cluster_item_key. A cluster peer holding the shared Fernet key can upload a crafted extra-valid archive and overwrite security-sensitive files such as /var/ossec/etc/ossec.conf. Replacing ossec.conf can configure root-executed commands and lead to code execution after a service reload. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.

• CWE-73

• https://github.com/wazuh/wazuh/commit/7f13682cf5f01f69452f723a608ab2d89cfb2133Patch
• https://github.com/wazuh/wazuh/pull/36296Issue Tracking, Patch
• https://github.com/wazuh/wazuh/releases/tag/v4.14.6Patch, Release Notes
• https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta3Patch, Release Notes
• https://github.com/wazuh/wazuh/security/advisories/GHSA-3v57-hgvj-3vj2Exploit, Vendor Advisory

Published

Aug 19, 2026

Last Modified

Sep 15, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49434Improper Input Validation vulnerability in Apache ActiveMQ B…7.5
• CVE-2026-49435Keysight IxChariot Endpoint and associated products contain …9.8
• CVE-2026-49436LinkAce is a self-hosted archive to collect website links. P…7.3
• CVE-2026-49439OpenRemote is an open-source internet-of-things platform. Pr…4.3
• CVE-2026-4944vllm-project/vllm version 0.14.1 contains a vulnerability wh…8.8
• CVE-2026-49440Deno is a JavaScript, TypeScript, and WebAssembly runtime. P…7.4
• CVE-2026-49443authentik is an open-source identity provider. Prior to vers…8.8
• CVE-2026-49444n8n is an open source workflow automation platform. Prior to…8.5
• CVE-2026-49445Cilium is a networking, observability, and security solution…8.8
• CVE-2026-49446Cosmos provides users the ability self-host a home server by…6.1
• CVE-2026-49447Cosmos provides users the ability self-host a home server by…5.3
• CVE-2026-49448authentik is an open-source identity provider. Prior to vers…9.8