CVE-2026-61802

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to redact it. The REST API provides a masking control, mask_sensitive_config, that redacts sensitive fields such as authd.pass and cluster.key from configuration responses for users who lack update-config permission, and every config-read endpoint carries this decorator except GET /cluster/local/config. That endpoint, backed by read_config_wrapper, is gated only by cluster:read and returns the local node's cluster configuration including the cleartext key, whereas its siblings return the same value masked. As a result, any account with the default readonly or cluster_readonly role, which is explicitly denied update-config precisely so it cannot view secrets, receives the real cluster key. Because the cluster key authenticates and encrypts traffic between cluster nodes, disclosing it to an unprivileged account provides the authentication precondition for the cluster-peer remote code execution chains established by prior advisories. This issue is fixed in version 4.14.

• CWE-200
• CWE-522

• https://github.com/wazuh/wazuh/commit/1c55af25ebb160bddbde591efc19bb77b01282e7Patch
• https://github.com/wazuh/wazuh/security/advisories/GHSA-chmg-89pf-2q82Exploit, Vendor Advisory
• https://github.com/wazuh/wazuh/security/advisories/GHSA-chmg-89pf-2q82Exploit, Vendor Advisory

Published

Aug 28, 2026

Last Modified

Sep 15, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61793Nuxt OG Image generates OG Images with Vue templates in Nuxt…6.9
• CVE-2026-61794Capsule is a multi-tenancy and policy-based framework for Ku…6.8
• CVE-2026-61795Capsule is a multi-tenancy and policy-based framework for Ku…6.8
• CVE-2026-6180A race condition exists in PaperCut MF when processing badge…8.1
• CVE-2026-61800Wazuh is an open-source security platform providing unified …9.1
• CVE-2026-61801The `github.com/moby/sys/user` package provides Go utilities…5.5
• CVE-2026-61803Frappe Learning Management System (LMS) is a learning system…5.3
• CVE-2026-61804myTinyWMS is a free, open-source warehouse management system…8.1
• CVE-2026-61805Frappe Learning Management System (LMS) is a learning system…5.3
• CVE-2026-61806Frappe Learning Management System (LMS) is a learning system…5.3
• CVE-2026-61807Snipe-IT is an IT asset/license management system. Prior to …6.1
• CVE-2026-61808LightRAG provides simple and fast retrieval-augmented genera…9.8