CVE-2026-61800

Executive Summary

CVE-2026-61800 is a path traversal vulnerability (CWE-22) in the Wazuh open-source SIEM/XDR platform affecting versions 4.4.0 through 4.14.6. A party in possession of the Wazuh cluster key can abuse the cluster file synchronization mechanism to write, overwrite, or delete arbitrary files under /var/ossec on worker nodes. Because attacker-chosen locations within that directory tree include paths that are executed as root, successful exploitation results in remote code execution with root privileges on affected worker nodes, yielding a CVSS v3.1 base score of 9.1 (Critical). The flaw is an incomplete fix for CVE-2026-30893 and is remediated in Wazuh 4.14.7.

Technical Analysis

Wazuh clusters operate with a primary (master) node and one or more worker nodes. Configuration, rule, decoder, and integration assets are synchronized from the primary to workers through a cluster file synchronization process. Each synchronized file is associated with a cluster_item_key, a logical identifier that declares the destination directory for that item type within /var/ossec.

The vulnerable function in the described code path is update_master_files_in_worker(). This function contains two distinct branches:

1. Merged branch — handles files subject to merge semantics.
2. Non-merged branch — handles files that are synchronized verbatim.

On the primary node, and on the merged branch executed by workers, a destination check validates that each staged file is written into the directory declared by its cluster_item_key. In versions 4.4.0 through 4.14.6, the non-merged branch on worker nodes omitted this destination check. The only remaining path control was safe_join(), which confines the resolved path to the /var/ossec prefix but does not constrain the file to the directory associated with its cluster_item_key.

The practical consequence is a path-confusion primitive. An attacker who holds the cluster key — the symmetric credential used to authenticate cluster peers — can cause a worker to move a staged file to an attacker-chosen location anywhere beneath /var/ossec, including directories and filenames that Wazuh or the operating system executes as root. The delete branch exhibits the same gap: a peer can direct deletions to arbitrary paths under /var/ossec that are not the intended target of the item key.

This is explicitly described as an incomplete fix. CVE-2026-30893 addressed traversal outside /var/ossec; the present issue concerns redirection within /var/ossec, which is why the safe_join() confinement is insufficient on its own. Both the write/overwrite vector and the delete vector share the missing destination validation.

Attack surface. The primitive requires possession of the cluster key, so it is not remotely triggerable by an unauthenticated internet attacker. The CVSS vector reflects this: PR:H (High privileges required) — the attacker must already be a trusted cluster peer. However, S:C (Scope: Changed) reflects that compromise of the cluster synchronization channel escapes into the host operating system context, and C:H/I:H/A:H reflects full confidentiality, integrity, and availability loss on the worker node.

Preconditions. Network reachability to the cluster daemon port on a worker node and valid cluster-key authentication. In many deployments cluster traffic is restricted to a private management network or an overlay such as a VPN; misconfigured or flat networks expand exposure.

Exploitation Scenarios

No public exploit code or Nuclei template is available for this CVE. The chain below is derived strictly from the described vulnerability mechanism.

1. Reconnaissance and target identification. The attacker identifies Wazuh worker nodes and the cluster service port. This may be accomplished through Shodan-style internet scanning for Wazuh management interfaces, by inspecting an environment directly, or, in the insider case, from documentation and known cluster topology. The attacker confirms the version banner falls within 4.4.0–4.14.6.

2. Credential acquisition. Exploitation requires the cluster key. Typical acquisition paths include compromised configuration backups, leaked ossec.conf or cluster configuration artifacts, lateral movement from another host that already holds the key, or an insider with legitimate read access to cluster credentials. This step is a prerequisite rather than a separate vulnerability.

3. Triggering the flaw class. The attacker authenticates to a worker node's cluster synchronization service as a trusted peer (the master, or a peer impersonating the master). The attacker stages one or more files intended to be synchronized via the non-merged branch and crafts the associated cluster_item_key/path such that, after safe_join() confines resolution under /var/ossec, the file is placed at an attacker-chosen location beneath that root rather than in the directory declared by the item key. This is the path traversal: the destination check that exists on the primary node and the worker's merged branch is absent here.

4. Write, overwrite, or delete. The attacker lands content at an attacker-selected path under /var/ossec, overwrites an existing file to hijack its behavior, or uses the equally-affected delete branch to remove a file at an attacker-chosen location. File integrity is fully under attacker control for reachable paths.

5. Execution as root. Because attacker-selected destinations include paths executed by Wazuh or the underlying system as root, the written or overwritten file is executed with root privileges on the worker node. This converts a trusted-cluster file-write primitive into remote code execution as root.

6. Post-exploitation. With root on a worker node the attacker can read all security telemetry Wazuh processes from that node, disable or tamper with agents, pivot to adjacent systems using the node's network position and credentials, persist, and disrupt monitoring (availability impact). Because Wazuh workers ingest and forward security data, root access also enables evasion of the very detection the platform exists to provide.

Impact Assessment

Wazuh is a widely deployed open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. Its worker nodes are security-critical infrastructure: they receive agent telemetry, run detection logic, and forward events to the indexer. Root-level compromise of a worker node is therefore a high-value objective for an adversary.

The CVSS v3.1 base score is 9.1 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Subscore interpretation:

• AV:N (Network) — the flaw is reachable over the network via the cluster synchronization channel.
• AC:L (Low) — no special conditions beyond cluster-key possession are required to trigger it once the sync path is reached.
• PR:H (High) — the attacker must hold the cluster key; this is what limits the threat to insiders, compromised peers, and exfiltrated credentials.
• UI:N (None) — no victim interaction is required.
• S:C (Changed) — impact crosses a security boundary: from within the cluster-sync context into the host OS as root.
• C:H / I:H / A:H — complete loss of confidentiality, integrity, and availability on the worker node.

Blast radius. A single compromised worker yields root on that host. If the same cluster key is shared across an entire fleet — the common deployment pattern — every worker reachable from the attacker's position is exposed. Because the primitive permits arbitrary write and delete within /var/ossec, the attacker can disable detections, remove evidence, or persist. The most serious outcome is full root RCE combined with the ability to blind a defensive monitoring platform, making this both a compromise and an anti-forensics capability.

EPSS context. EPSS is 0.00614 (47.8th percentile). This low exploitation-probability estimate reflects the high-privilege precondition (cluster key) and lack of public weaponization, but it does not lower the severity for organizations where cluster keys have been broadly distributed. CISA KEV status is NO, and no public exploit code or Nuclei template is currently known.

Detection Guidance

Sigma Rule

title: Wazuh Cluster File Synchronization Path Traversal (CVE-2026-61800)
id: 7c1e2f9a-4b3d-4a21-9f6e-2a8d5c3b1f07
status: experimental
description: Detects worker nodes writing or deleting files under /var/ossec outside the directory declared by their cluster_item_key during cluster file synchronization, indicative of CVE-2026-61800.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-61800
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - attack.privilege_escalation
  - cve.2026.61800
logsource:
  product: wazuh
  service: cluster
detection:
  selection_process:
    Image|endswith: 'wazuh-clusterd'
  selection_path:
    - file_path|contains: '/var/ossec/'
  filter_legitimate:
    file_path|startswith:
      - '/var/ossec/etc/'
      - '/var/ossec/ruleset/'
      - '/var/ossec/agentless/'
  condition: selection_process and selection_path and not filter_legitimate
falsepositives:
  - Legitimate cluster synchronization of custom decoders, rules, or integrations placed in non-standard directories
level: high

YARA Rule

rule CVE_2026_61800_Wazuh_Cluster_Path_Traversal
{
    meta:
        description = "Detects artifacts consistent with Wazuh cluster file synchronization path traversal leading to root RCE"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-61800"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $func = "update_master_files_in_worker"
        $safe = "safe_join"
        $key  = "cluster_item_key"
        $path = "/var/ossec"

    condition:
        uint32(0) == 0x7f454c46 and 2 of ($func, $safe, $key, $path)
}

Suricata IDS Rule

alert tcp any any -> any 1516 (msg:"CVE-2026-61800 Wazuh Cluster File Sync Path Traversal Attempt"; flow:established,to_server; content:"cluster_item_key"; nocase; content:"/var/ossec"; nocase; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,2026-61800; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-61800; sid:2026618001; rev:1;)

Elastic Detection

process where event.type in ("start", "change") and
  process.name == "wazuh-clusterd" and
  process.args : "*/var/ossec/*" and
  not process.args : ("/var/ossec/etc/*", "/var/ossec/ruleset/*", "/var/ossec/agentless/*", "/var/ossec/logs/*")

Splunk SPL Query

index=wazuh sourcetype=wazuh:cluster OR sourcetype=wazuh:manager
| search "update_master_files_in_worker" OR "cluster_item_key" OR "safe_join"
| rex field=_raw "path=\"(?<dest_path>[^\"]+)\""
| where match(dest_path, "^/var/ossec/") AND NOT match(dest_path, "^/var/ossec/(etc|ruleset|agentless|logs)/")
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_path) as suspicious_paths by host, src_ip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="wazuh,cluster,cve-2026-61800,">
  <rule id="100610" level="12">
    <decoded_as>json</decoded_as>
    <field name="cluster_item_key">\.+</field>
    <regex field="file_path">^/var/ossec/</regex>
    <description>CVE-2026-61800: Possible Wazuh cluster path traversal - file synchronized outside declared cluster_item_key directory</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cluster_integrity,</group>
  </rule>

  <rule id="100611" level="14">
    <if_sid>100610</if_sid>
    <regex field="file_path" negate="yes">^/var/ossec/(etc|ruleset|agentless|logs)/</regex>
    <description>CVE-2026-61800: Wazuh cluster synchronization wrote file to unexpected path under /var/ossec (possible root RCE)</description>
    <group>cluster_integrity,exploit_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY — 2 independent sources confirm fix). NVD and OSV both confirm that the defect is resolved in a released version, though no vendor advisory URL was supplied in the intelligence data.

1) Immediate mitigations (before patching is possible):

• Restrict cluster daemon reachability. Firewall the Wazuh cluster synchronization port so only legitimate peer node addresses can connect. Do not expose cluster services to shared, flat, or untrusted networks.
• Rotate the cluster key. Because exploitation requires the cluster key, rotating it invalidates any key an attacker may hold and forces re-authentication across the cluster.
• Audit key distribution. Identify every host, backup, and configuration artifact containing the cluster key and consolidate control over them.
• Monitor and baseline the contents of /var/ossec. Establish file integrity monitoring for paths outside the expected per-item-key directories so unexpected writes or deletions are alerted.
• Apply the principle of least privilege to node placement. Isolate worker nodes so that a single root compromise does not grant a network position that enables lateral movement to adjacent high-value systems.

2) Patch / upgrade steps:

• Upgrade Wazuh to version 4.14.7 or later, which contains the complete fix that restores the destination check on the worker's non-merged branch and closes the delete-branch gap.
• Because this CVE is an incomplete fix for CVE-2026-30893, confirm that any environment previously mitigated against CVE-2026-30893 without upgrading to 4.14.7 is independently remediated by the new release.
• After upgrading, verify cluster synchronization behavior on a canary worker before rolling out fleet-wide, and re-baseline file integrity monitoring expectations.

3) Long-term hardening:

• Adopt a formal patch cadence for security infrastructure and treat cluster keys as high-value secrets subject to rotation, vaulting, and audit.
• Segment management planes: cluster and API traffic should live on dedicated, strictly filtered networks.
• Continuously monitor /var/ossec with FIM and alert on any deviation from the expected directory layout tied to cluster_item_key.
• Where feasible, run Wazuh worker nodes with additional host-level containment (least-privilege service accounts, restricted outbound egress, and hardened cron/scheduled execution paths) so that a root write to /var/ossec has a reduced execution surface.
• Track CVE-2026-30893 and CVE-2026-61800 as related issues in vulnerability management to ensure fixes are not partially applied.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-61800
• OSV: https://osv.dev/list?q=CVE-2026-61800
• Related prior CVE: https://nvd.nist.gov/vuln/detail/CVE-2026-30893 (traversal outside /var/ossec; incomplete fix lineage)
• Wazuh project: https://wazuh.com (verify the 4.14.7 release notes and security advisories for the authoritative fix)
• CISA KEV: Not listed — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild evidence: None. CISA KEV status is NO, no public exploit code or Nuclei template is available, and EPSS is 0.00614 (47.8th percentile). No known threat actor campaigns are associated with this CVE. Exploitation is currently constrained by the High-privilege precondition (possession of the cluster key); risk is concentrated in environments where that key may have been leaked or is broadly distributed.