CVE-2026-61802

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to redact it. The REST API provides a masking control, mask_sensitive_config, that redacts sensitive fields such as authd.pass and cluster.key from configuration responses for users who lack update-config permission, and every config-read endpoint carries this decorator except GET /cluster/local/config. That endpoint, backed by read_config_wrapper, is gated only by cluster:read and returns the local node's cluster configuration including the cleartext key, whereas its siblings return the same value masked. As a result, any account with the default readonly or cluster_readonly role, which is explicitly denied update-config precisely so it cannot view secrets, receives the real cluster key. Because the cluster key authenticates and encrypts traffic between cluster nodes, disclosing it to an unprivileged account provides the authentication precondition for the cluster-peer remote code execution chains established by prior advisories. This issue is fixed in version 4.14.

• CWE-200
• CWE-522

• https://github.com/wazuh/wazuh/commit/1c55af25ebb160bddbde591efc19bb77b01282e7Patch
• https://github.com/wazuh/wazuh/security/advisories/GHSA-chmg-89pf-2q82Exploit, Vendor Advisory
• https://github.com/wazuh/wazuh/security/advisories/GHSA-chmg-89pf-2q82Exploit, Vendor Advisory

Published

Aug 28, 2026

Last Modified

Sep 15, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61783Wazuh is an open-source security platform providing unified …6.5
• CVE-2026-6179Stored Cross Site Scripting in NightWolf Penetration Testing…5.4
• CVE-2026-61790Weblate is a web-based continuous localization platform used…4.4
• CVE-2026-61792Weblate is a web-based continuous localization platform used…7.7
• CVE-2026-6180A race condition exists in PaperCut MF when processing badge…8.1
• CVE-2026-61800Wazuh is an open-source security platform providing unified …9.1
• CVE-2026-61807Snipe-IT is an IT asset/license management system. Prior to …6.3
• CVE-2026-61808LightRAG provides simple and fast retrieval-augmented genera…9.8
• CVE-2026-6181The Device Configuration Framework is vulnerable to an authe…5.9
• CVE-2026-6182A vulnerability was identified in code-projects Simple Conte…7.3
• CVE-2026-61824Defuddle cleans up HTML pages. Prior to 0.19.1, site extract…8.2
• CVE-2026-61828Nixpkgs is a collection of software packages that can be ins…8.5