CVE-2026-61800

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code execution as root. During cluster file synchronization, the non-merged branch of update_master_files_in_worker() moves each staged file to a destination derived only from safe_join(), which confines the path to /var/ossec but never verifies that the file lands in the directory declared by its cluster_item_key. Because the destination check present on the primary node and on the worker's merged branch was not applied, a peer can place files at attacker-chosen locations under /var/ossec, including paths that are executed as root, and the delete branch has the same gap. This is an incomplete fix for CVE-2026-30893, which addressed traversal outside /var/ossec but left this path able to redirect files anywhere within it. This issue is fixed in version 4.14.7.

• CWE-22

• https://github.com/wazuh/wazuh/commit/f7f7c4d2d9e683c5d42e997fe7028a3fb2578853Patch
• https://github.com/wazuh/wazuh/security/advisories/GHSA-3jff-488g-335fExploit, Vendor Advisory

Published

Aug 28, 2026

Last Modified

Sep 15, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61791OCO-Server is a self-hosted endpoint management application …7.4
• CVE-2026-61792Weblate is a web-based continuous localization platform used…7.7
• CVE-2026-61793Nuxt OG Image generates OG Images with Vue templates in Nuxt…6.9
• CVE-2026-61794Capsule is a multi-tenancy and policy-based framework for Ku…6.8
• CVE-2026-61795Capsule is a multi-tenancy and policy-based framework for Ku…6.8
• CVE-2026-6180A race condition exists in PaperCut MF when processing badge…8.1
• CVE-2026-61801The `github.com/moby/sys/user` package provides Go utilities…5.5
• CVE-2026-61802Wazuh is an open-source security platform providing unified …6.5
• CVE-2026-61803Frappe Learning Management System (LMS) is a learning system…5.3
• CVE-2026-61804myTinyWMS is a free, open-source warehouse management system…8.1
• CVE-2026-61805Frappe Learning Management System (LMS) is a learning system…5.3
• CVE-2026-61806Frappe Learning Management System (LMS) is a learning system…5.3