Wazuh wazuh-manager: Path traversal in CDB list cluster handlers
Summary
Wazuh wazuh-manager from 4.1.1 before 4.14.8 contains a path traversal flaw in the get_lists() and delete_list_file() CDB list handlers. A compromised cluster worker can send traversal or absolute paths through the internal cluster RPC path, bypassing REST validation and RBAC. This allows reading or deleting files on the master, including the RBAC database rbac.db. The attacker needs control of a cluster worker on the internal network, so the risk is mainly for multi-node clusters.
Affected
- Wazuh wazuh-manager from 4.1.1 before 4.14.8
- Single-node managers without cluster workers are not reachable through this path.
Fixed in
- Fixed in Wazuh 4.14.8 (vendor-indicated; the specific fix commit for this CVE is not confirmed).
Workaround
- No vendor-documented workaround.
- Restrict who can join the cluster and harden worker hosts until the upgrade is applied.
Exploitation
- No evidence of exploitation in the wild; not listed in CISA KEV.
- CISA SSVC: exploitation PoC, not automatable, total technical impact.
- EPSS 0.00232. No public proof of concept found.
Our recommendation
- Upgrade wazuh-manager and all cluster nodes to 4.14.8 or later.
- Verify that all cluster workers are trusted and hardened; review cluster membership.
- Check rbac.db and other master files for unexpected changes.
- Monitor cluster activity for unusual file access or deletion requests.
- Single-node installations: priority is low, but upgrade in the regular cycle.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wazuh v4.14.8 release github.com
- Wazuh GHSA-vc33-wcqf-cwgv advisory github.com
- VulnCheck advisory www.vulncheck.com
- OSV CVE-2026-74033 osv.dev
- VulDB 417684 vuldb.com
- Wazuh 4.14.8 release notes documentation.wazuh.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:33.
Original description (NVD)
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path, bypassing REST validation and RBAC to delete files like rbac.db.
NVD references (4)
- https://github.com/wazuh/wazuh/releases/tag/v4.14.8
- https://github.com/wazuh/wazuh/security/advisories/GHSA-vc33-wcqf-cwgv
- https://www.vulncheck.com/advisories/wazuh-from-4.1.1-before-4.14.8-path-traversal-in-cdb-list-cluster-handle…
- https://github.com/wazuh/wazuh/security/advisories/GHSA-vc33-wcqf-cwgv
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.