{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/wazuh-3.9.0--v--4.14.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-74040"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Wazuh (3.9.0 \u003c= v \u003c 4.14.8)","Wazuh (\u003c 4.14.8)","Wazuh (4.1.1 - 4.14.7)","Wazuh (4.1.0-4.14.7)","Wazuh (4.6.0 - 4.14.7)","Wazuh (\u003e= 4.3.0, \u003c 4.14.8)","Wazuh (3.12.0 \u003c= version \u003c 4.14.8)"],"_cs_severities":["critical"],"_cs_tags":["privilege-escalation","configuration-bypass","cve-2026-74041","web-vulnerability","path-traversal","wazuh","vulnerability","authentication-bypass","cve-2026-74035","remote-code-execution","security-configuration-assessment","persistence"],"_cs_type":"advisory","_cs_vendors":["Wazuh"],"content_html":"\u003cp\u003eWazuh versions 3.9.0 through 4.14.7 contain a critical arbitrary file overwrite vulnerability located within the MasterHandler.process_files_from_worker component. The flaw arises from a basename path traversal bypass combined with a lack of input validation regarding file path enforcement. This vulnerability enables an attacker who has compromised a cluster worker node to manipulate the file synchronization process to overwrite sensitive files on the master node, specifically ossec.conf and agent.conf. By modifying these configuration files, an attacker can inject arbitrary commands, facilitating remote code execution with root privileges on the master node, which subsequently propagates to all connected agents. This vulnerability presents a high risk to security operations as it subverts the integrity of the centralized security management architecture.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker compromises a cluster worker node through unrelated vectors.\u003c/li\u003e\n\u003cli\u003eAttacker initiates a malicious synchronization request to the master node's MasterHandler.process_files_from_worker.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a path traversal payload leveraging the trailing-slash basename bypass.\u003c/li\u003e\n\u003cli\u003eMasterHandler processes the malicious path, failing to validate the destination against restricted directories.\u003c/li\u003e\n\u003cli\u003eThe system overwrites the target file, such as /var/ossec/etc/ossec.conf, with attacker-controlled content.\u003c/li\u003e\n\u003cli\u003eThe attacker injects malicious commands or configurations into the overwritten file.\u003c/li\u003e\n\u003cli\u003eThe master node restarts or reloads the configuration, executing the injected commands as root.\u003c/li\u003e\n\u003cli\u003eMalicious configurations are synchronized to all connected agents, escalating impact across the enterprise footprint.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full control over the Wazuh manager and its downstream agents. As the manager typically runs with root-level privileges, this permits the execution of arbitrary commands across the entire security infrastructure. This results in the potential for complete data exfiltration, disabling of security monitoring, and lateral movement throughout the environment where the Wazuh management plane is deployed.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all Wazuh manager and cluster worker installations to version 4.14.8 or later immediately to resolve the vulnerability in MasterHandler.\u003c/li\u003e\n\u003cli\u003eImplement strict network segmentation between cluster workers and the master node to ensure only authorized nodes can communicate with the MasterHandler component.\u003c/li\u003e\n\u003cli\u003eReview and monitor file integrity of critical configuration files, specifically /var/ossec/etc/ossec.conf and /var/ossec/etc/shared/agent.conf, for unexpected modifications.\u003c/li\u003e\n\u003cli\u003eAudit logs for the cluster communication service to identify anomalous synchronization requests from worker nodes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T14:40:04Z","date_published":"2026-10-13T14:36:29Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wazuh-file-overwrite/","summary":"Wazuh versions 3.9.0 through 4.14.7 are vulnerable to an arbitrary file overwrite attack in MasterHandler that allows cluster workers to gain root remote code execution by modifying critical configuration files.","title":"Arbitrary File Overwrite Vulnerability in Wazuh MasterHandler","url":"https://feed.craftedsignal.io/briefs/2026-10-wazuh-file-overwrite/"}],"language":"en","title":"CraftedSignal Threat Feed - Wazuh (3.9.0 \u003c= v \u003c 4.14.8)","version":"https://jsonfeed.org/version/1.1"}