CVE-2026-74031

Executive Summary

CVE-2026-74031 is a path traversal vulnerability (CWE-22) in the delete_rule_file and delete_decoder_file helper functions of the Wazuh security platform, present from version 4.1.1 up to (but not including) 4.14.8. An attacker who already holds the Wazuh cluster key can invoke these helpers through the DistributedAPI and supply traversal sequences in an unvalidated filename parameter, causing arbitrary file deletion as the wazuh user. Because the deleted files include ossec.conf, client.keys, and rule sets, the impact is high-integrity and high-availability: successful exploitation can disable detection logic, sever agent authentication, and cripple the manager's configuration. No public PoC, exploit code, or Nuclei template is currently available, and no patch evidence has been confirmed.

Technical Analysis

Wazuh is an open-source SIEM/XDR platform built around a manager/agent architecture. The manager's cluster components communicate over an encrypted channel (the "cluster key"), and internal components expose administrative helper functions through the DistributedAPI layer. The vulnerability resides in two helpers, delete_rule_file and delete_decoder_file, whose purpose is to remove rule and decoder files from their respective directories.

The flaw is a classic path traversal (CWE-22). The filename parameter accepted by these helpers is not validated or canonicalized before being used to construct a deletion path. By embedding sequences such as ../ in the filename value, an authenticated cluster participant can cause the helper to resolve a path outside the intended rules/decoders directory. The resulting unlink/file-deletion operation is performed under the privileges of the wazuh user, which owns and can write to the manager's configuration and key material.

Two factors shape the attack surface:

1. Privilege requirement (PR:H): The attacker must hold the cluster key. This is not an unauthenticated remote flaw; it requires either a compromised cluster worker node, stolen cluster credentials, or an already-established foothold in the cluster. The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H reflects this — network-reachable, low attack complexity, but high privileges required, with no confidentiality impact and high integrity/availability impact.
2. No confidentiality impact (C:N): The helper performs deletion, not readback, so data is not exfiltrated by the primitive itself. The integrity impact stems from destruction of critical files; the availability impact stems from the manager losing configuration and agent-key state.

The specific files identified in the description — ossec.conf (the main manager configuration), client.keys (the agent authentication key store), and rule/decoder files — are all critical to Wazuh operation. Their deletion does not require code execution; it directly degrades or disables the security monitoring function, which is the core value of the product.

No source code, commit diff, or advisory detail beyond the CVE description was provided. The exact parsing behavior, whether the parameter is a query string, JSON body field, or internal RPC argument, and whether any secondary validation exists in adjacent code, are not disclosed. Analysis is therefore bounded to the vulnerability class and the named functions.

Exploitation Scenarios

The following chain is inferred from the CVE description and the vulnerability class. No public PoC exists, and no specific request payloads, endpoint paths, or parameter encodings beyond the literal filename parameter and ../ traversal concept are asserted here.

1. Reconnaissance / target identification. The attacker identifies a Wazuh manager deployment (often exposed on the manager API/agent ports, HTTPS login pages, or discoverable via Shodan/certificate fingerprints). The more relevant precondition is internal: the attacker must determine that they hold, or can obtain, the cluster key — for example, via a compromised cluster worker node, leaked configuration, or lateral movement within the environment. Without the cluster key, the flaw is not reachable.

2. Triggering the flaw class. With the cluster key, the attacker invokes the delete_rule_file or delete_decoder_file helper through the DistributedAPI. The request supplies a filename value containing directory-traversal sequences. Because the value is unvalidated, the helper resolves the supplied name relative to the intended rules/decoders directory but escapes it, pointing at a target file elsewhere on the filesystem. The attacker repeats the request, varying the traversal depth to reach the desired target.

3. Payload / execution at the vulnerability-class level. The "payload" is a crafted path, not code. The helper performs its normal deletion operation on the resolved path as the wazuh user. No memory corruption, shell injection, or command execution is required; the primitive is arbitrary file deletion constrained to what the wazuh user can remove.

4. Post-exploitation impact. By deleting ossec.conf, the attacker removes or corrupts the manager's configuration, potentially halting or misconfiguring the manager on the next reload/restart. By deleting client.keys, the attacker severs the agent authentication store, disrupting agent connectivity and enrollment. By deleting rule and decoder files, the attacker blinds detection, suppressing alerts for concurrent malicious activity. Combined, these actions constitute a denial-of-security and integrity attack against the monitoring platform itself — a classic "blind the defender" precursor to further operations.

Impact Assessment

The CVSS 3.1 base score is 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H.

• Attack Vector (AV:N): The DistributedAPI is network-reachable, so no physical or adjacent-only access is required.
• Attack Complexity (AC:L): Sending traversal sequences in a parameter is trivial once the cluster key is held — no race condition or special conditions are needed.
• Privileges Required (PR:H): The attacker needs the cluster key, which is a high-value, high-privilege credential. This is the primary constraint on exploitation.
• User Interaction (UI:N): No victim action is needed.
• Scope (S:U): Impact is contained within the Wazuh manager's security authority.
• Confidentiality (C:N): The primitive deletes; it does not read or exfiltrate data.
• Integrity (I:H): Deletion of ossec.conf, client.keys, and rule/decoder files is a serious, potentially irreversible integrity loss.
• Availability (A:H): Loss of configuration and key material can disable the manager and disconnect the agent fleet.

Blast radius: An affected manager can lose its entire detection rule set, agent key store, and primary configuration. In a centralized deployment, that manager may serve hundreds or thousands of agents; a successful attack can blind monitoring across the entire monitored estate. Because the deletion occurs as the wazuh user, anything that user owns or can write is in scope. Recovery depends on backups and re-enrollment of agents — a costly, high-urgency operation. Because the deleted files are security controls, the incident may be a prelude to (or cover for) other intrusions.

Detection Guidance

Detection should focus on (a) anomalous cluster/DistributedAPI activity from worker nodes, (b) file-deletion events against critical Wazuh paths, and (c) traversal strings in API parameters. The rules below are illustrative starting points and must be tuned to the local deployment's log formats, file paths, and baseline.

Sigma Rule

title: Wazuh DistributedAPI Path Traversal File Deletion Attempt (CVE-2026-74031)
id: 8f2c1a64-0b7e-4d3a-9c1e-7a5b2f9c0d31
status: experimental
description: Detects traversal sequences in Wazuh delete_rule_file/delete_decoder_file helper invocations, or deletion of critical Wazuh files.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-74031
author: SOC Detection Engineering
date: 2026/01/01
logsource:
  product: wazuh
  service: manager
detection:
  selection_helper:
    - 'delete_rule_file'
    - 'delete_decoder_file'
  selection_traversal:
    filename|contains:
      - '../'
      - '..\\'
      - '%2e%2e%2f'
      - '%2e%2e%5c'
  condition: selection_helper and selection_traversal
fields:
  - filename
  - srcip
  - user
falsepositives:
  - Legitimate administrative tooling that sanitizes filenames before submission
level: high
tags:
  - attack.t1485
  - cve.2026-74031

YARA Rule

rule CVE_2026_74031_Wazuh_PathTraversal
{
    meta:
        description = "Detects path traversal attempts targeting Wazuh delete helpers (CVE-2026-74031)"
        author = "SOC Detection Engineering"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-74031"
        date = "2026-01-01"
        severity = "high"

    strings:
        $helper1 = "delete_rule_file" ascii wide
        $helper2 = "delete_decoder_file" ascii wide
        $trav1   = "../" ascii wide
        $trav2   = "..\\" ascii wide
        $target1 = "ossec.conf" ascii wide
        $target2 = "client.keys" ascii wide

    condition:
        (any of ($helper*)) and (any of ($trav*)) or
        (any of ($helper*)) and (any of ($target*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-74031 Wazuh delete helper path traversal attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"delete_rule_file"|nocase; http.request_body; content:"filename"; nocase; pcre:"/filename[^&]*(\.\.\/|\.\.%2f|%2e%2e%2f|\.\.\\)/i"; reference:cve,2026-74031; classtype:attempted-admin; sid:202674031; rev:1;)

Elastic Detection

sequence by host.name with maxspan=30s
  [any where process.args : ("*delete_rule_file*", "*delete_decoder_file*")]
  [file where file.path : ("*/ossec.conf", "*/client.keys", "*/etc/rules/*", "*/etc/decoders/*") and event.action : "deleted"]

Splunk SPL Query

index=wazuh sourcetype=wazuh:manager OR sourcetype=wazuh:api
| search ("delete_rule_file" OR "delete_decoder_file")
| rex field=_raw "filename[=\":\s]+(?<fname>[^\"\s,}]+)"
| where match(fname, "(\.\./|\.\.%2f|%2e%2e%2f|\.\.\\)")
| stats count min(_time) as first_seen max(_time) as last_seen values(fname) as filenames by src_ip, user, host
| where count > 0

Wazuh OSSEC Rule

<group name="wazuh,cve-2026-74031,path_traversal,">
  <rule id="100740" level="12">
    <decoded_as>json</decoded_as>
    <field name="function">delete_rule_file|delete_decoder_file</field>
    <regex field="filename">\.\./|\.\.%2f|%2e%2e%2f|\.\.\\</regex>
    <description>CVE-2026-74031: Wazuh delete helper invoked with path traversal in filename - possible arbitrary file deletion attempt.</description>
    <mitre>
      <id>T1485</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, commit, or release note has been confirmed by any tracked source. The description implies a fixed boundary of "before 4.14.8," but this cannot be verified from available evidence. The following measures should be applied with that caveat.

1) Immediate mitigations

• Treat the Wazuh cluster key as a Tier-0 secret. Rotate it if there is any suspicion of exposure, and audit all systems that hold it (worker nodes, configuration stores, backups).
• Restrict network reachability of the DistributedAPI and cluster ports to trusted manager/worker hosts only; do not expose them to untrusted networks.
• Apply least privilege to the wazuh user at the OS level: ensure it cannot delete files outside its required rules/decoders/config directories. Where feasible, use immutable attributes or restrictive ACLs on ossec.conf, client.keys, and rule/decoder directories.
• Maintain frequent, out-of-band backups of ossec.conf, client.keys, rules and decoders, with integrity verification and tested restore procedures.
• Enable and forward Wazuh manager and API logs to a separate, hardened log store so deletion of local config cannot also destroy the audit trail.

2) Patch / upgrade steps

• Monitor the official Wazuh security advisories and release channels for a fixed version. No verified patch reference exists as of this report; do not assume a specific version is safe without confirmation from the vendor.
• When a fix is published, stage it in a test cluster first, verify the helper functions reject traversal input, and then roll out to production managers and workers.
• Until a fix is confirmed, treat any version in the stated range (4.1.1 through the 4.14.x line) as potentially vulnerable.

3) Long-term hardening

• Enforce input validation and path canonicalization for all file-handling helpers as a code-review requirement; deletion operations should be constrained to a resolved, allow-listed base directory.
• Adopt a zero-trust posture for inter-component credential use: scope cluster keys, rotate them, and monitor for their use from unexpected sources.
• Deploy the detection rules above and alert on any traversal strings entering Wazuh APIs or any deletion of ossec.conf, client.keys, or rule/decoder files.
• Include "delete critical security configuration" scenarios in purple-team exercises to validate both detection and recovery.

References

• NVD — CVE-2026-74031: https://nvd.nist.gov/vuln/detail/CVE-2026-74031
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1485 — Data Destruction: https://attack.mitre.org/techniques/T1485/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Wazuh Project — official security advisories and release notes: https://wazuh.com (consult the vendor's advisory/release channel for authoritative patch status; no fix confirmed at time of writing)

No public proof-of-concept, exploit code, Nuclei template, or CISA KEV entry was identified for this CVE. No threat actor campaign or in-the-wild exploitation evidence is available in the provided data. Exploitation requires prior possession of the cluster key, which limits opportunistic mass exploitation, though it remains a high-value primitive for an attacker already inside a Wazuh-managed environment.