CVE-2026-74033

Executive Summary

CVE-2026-74033 is a path traversal vulnerability (CWE-22) in the Wazuh security platform affecting versions from 4.1.1 before 4.14.8. The flaw resides in the get_lists() and delete_list_file() handlers of the CDB (Cyber Data Bureau) list subsystem, allowing a compromised cluster worker to read or delete arbitrary files on the master node — including the RBAC database (rbac.db) — by sending traversal or absolute-path filenames over the internal cluster RPC path. Because the attack requires an already-compromised worker node and high privileges (PR:H) adjacent to the cluster network (AV:A), it is primarily a privilege-escalation and lateral-movement primitive rather than an unauthenticated remote entry point.

Technical Analysis

Wazuh is an open-source SIEM and XDR platform that distributes work across a master node and one or more worker nodes. The cluster uses an internal RPC path for node-to-node communication, distinct from the public REST API. CDB lists are flat key-value files used by Wazuh rules and decoders to drive detection logic.

In affected versions (4.1.1 through 4.14.7), the cluster handlers get_lists() and delete_list_file() accept a list filename from the RPC caller without adequate canonicalization or path confinement. The NVD description indicates attackers can supply either traversal sequences (e.g., ../) or absolute paths as the list name. Because these handlers sit on the internal cluster RPC path, they operate outside the REST API's validation and RBAC enforcement layer — the checks that would normally constrain a worker's reach do not apply. The result is that a compromised worker can instruct the master to read files it should not expose, or delete files it should not remove.

The most consequential named target is rbac.db, the SQLite database underpinning the platform's role-based access control. Successful deletion of this file would degrade or disable authorization enforcement on the master, creating a downstream condition in which access controls are weakened or absent. Reading arbitrary master files could likewise expose credential material and configuration secrets. The CVSS subscores — Confidentiality High and Integrity High, with Availability None and Scope Unchanged — align precisely with this mechanism: attacker-readable data and attacker-modifiable files, but no direct service-outage impact and no privilege boundary crossing beyond the cluster itself.

Per the data provided, there is no public PoC, no Nuclei template, and no exploit code. The exact canonicalization routine and the full set of RPC parameters are not disclosed in the NVD description, so no further implementation-level claims should be made.

Exploitation Scenarios

The attack chain is dictated by the precondition that the attacker already controls a cluster worker node.

1. Reconnaissance / target identification. The attacker must first achieve code execution or credential compromise on a cluster worker, or otherwise gain the ability to issue authenticated internal cluster RPC calls. Worker-to-master RPC endpoints are internal, so the attacker would enumerate the master relationship and identify the RPC path used by CDB list operations. No public scanner or PoC exists for this specific CVE, so this phase is manual and operator-dependent.

2. Triggering the flaw class. With the ability to issue RPC calls, the attacker invokes the get_lists() or delete_list_file() handler and supplies a list name containing traversal sequences or an absolute path instead of a legitimate CDB list filename. Because the request is consumed on the internal cluster RPC path, it never passes through the REST API's validation or RBAC checks.

3. Payload / execution method. At the vulnerability-class level, the payload is simply the crafted filename string. The absence of path confinement causes the master to resolve the supplied path relative to (or entirely outside) the intended list directory. The attack does not require a memory-corruption primitive or injected code — it abuses an unsanitized path parameter.

4. Post-exploitation impact. Through get_lists() the attacker reads unintended master files (confidentiality impact); through delete_list_file() the attacker removes unintended files (integrity impact). Deleting rbac.db is the highest-value action named in the advisory, as it undermines authorization enforcement. From there, an attacker could consolidate access on the master, tamper with detection content by deleting CDB lists, and evade or disable the very monitoring the platform provides.

No public PoC is available; the chain above is inferred strictly from the vulnerability class and the details stated in the NVD description.

Impact Assessment

Business impact is concentrated on integrity of the SIEM/XDR control plane. An attacker who has already compromised a worker can escalate to reading and destroying master-side files, with rbac.db deletion being the most damaging named outcome — potentially disabling RBAC and enabling broader unauthorized actions against the master. Detection content stored in CDB lists could also be deleted, causing monitoring blind spots.

Blast radius is bounded by the CVSS configuration: AV:A means the attacker must be on the adjacent cluster network, and PR:H reflects that the attacker already holds high privileges on a worker. Scope is Unchanged (S:U), so the flaw does not, by itself, cross into unrelated security authorities outside the cluster. Confidentiality and Integrity are both High (C:H/I:H); Availability is None (A:N), consistent with the absence of a direct denial-of-service primitive. Overall severity is 6.1 (Medium). EPSS is not yet scored by FIRST.org, and CVE-2026-74033 is not listed in CISA KEV. No affected packaged versions are enumerated by downstream OSV sources in the provided data.

Detection Guidance

Sigma Rule

title: Potential Wazuh Cluster CDB List Path Traversal (CVE-2026-74033)
id: 3f9c1a42-7d21-4c88-9b6e-wazuhcdb74033
status: experimental
description: Detects path traversal or absolute-path filenames in Wazuh cluster log entries tied to CDB list handlers get_lists() or delete_list_file().
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-74033
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - attack.t1083
  - attack.t1485
logsource:
  product: wazuh
  service: ossec
detection:
  selection_handler:
    - 'get_lists'
    - 'delete_list_file'
  selection_traversal:
    - '..'
    - '%2e%2e'
    - '..%2f'
    - '/etc/'
    - 'rbac.db'
  condition: selection_handler and selection_traversal
falsepositives:
  - Legitimate administrative list maintenance referencing files under expected paths
level: high

YARA Rule

rule CVE_2026_74033_Wazuh_CDB_PathTraversal
{
    meta:
        author = "valtersit.com"
        description = "Detects Wazuh cluster RPC requests abusing get_lists/delete_list_file with traversal or absolute paths (CVE-2026-74033)"
        cve = "CVE-2026-74033"
        date = "2026-01-01"
    strings:
        $h1 = "get_lists" ascii wide nocase
        $h2 = "delete_list_file" ascii wide nocase
        $t1 = "../" ascii wide
        $t2 = "..\\" ascii wide
        $t3 = "%2e%2e" ascii wide nocase
        $f1 = "rbac.db" ascii wide nocase
        $a1 = "/etc/" ascii wide
    condition:
        ($h1 or $h2) and (any of ($t*) or $f1 or $a1)
}

Suricata IDS Rule

alert tcp any any -> any 1515 (msg:"CVE-2026-74033 Wazuh cluster CDB list path traversal attempt"; flow:established,to_server; content:"get_lists"; nocase; content:".."; distance:0; within:64; nocase; sid:202674033; rev:1; reference:cve,2026-74033; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-74033; classtype:attempted-admin; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

alert tcp any any -> any 1515 (msg:"CVE-2026-74033 Wazuh cluster CDB delete_list_file traversal or absolute path"; flow:established,to_server; content:"delete_list_file"; nocase; pcre:"/(\.\.\/|%2e%2e|rbac\.db|\/etc\/)/i"; sid:202674034; rev:1; reference:cve,2026-74033; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-74033; classtype:attempted-admin; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by host.name with maxspan=30s
  [process where event.dataset == "wazuh.cluster" and process.command_line : ("get_lists" or "delete_list_file")]
  [file where event.action == "deleted" and file.name == "rbac.db"]

Splunk SPL Query

index=wazuh sourcetype="wazuh:cluster" OR source="*wazuh*"
| search ("get_lists" OR "delete_list_file")
| search (".." OR "%2e%2e" OR "rbac.db" OR "/etc/")
| table _time host.name data.* user action
| sort -_time

Wazuh OSSEC Rule

<group name="wazuh,cluster,cve-2026-74033">
  <rule id="100740" level="12">
    <decoded_as>json</decoded_as>
    <match>get_lists|delete_list_file</match>
    <regex type="pcre2">(\.\./|%2e%2e|rbac\.db|/etc/)</regex>
    <description>CVE-2026-74033: Possible CDB list path traversal via Wazuh cluster RPC</description>
    <mitre>
      <id>T1190</id>
      <id>T1083</id>
      <id>T1485</id>
    </mitre>
    <group>cve_2026_74033,path_traversal,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Isolate cluster worker-to-master RPC traffic to a dedicated, tightly segmented management network; no worker should be reachable from general user or DMZ networks. Treat any worker compromise as a master compromise and rotate master credentials. Take offline, verifiable backups of rbac.db and all CDB lists so that accidental or malicious deletion can be recovered without loss of detection content. Monitor for unexpected deletion or modification of files in the Wazuh data directories and alert on RPC calls whose list names contain traversal sequences or absolute paths (see detection rules above).

2. Patch / upgrade steps. Per the CNA-described remediation boundary, upgrade to Wazuh 4.14.8 or later, which is the stated fixed version. Until 4.14.8 is validated in your environment, apply compensating controls as above. No vendor fix or workaround was listed in the provided patch-source data, so confirm the fixed release against the Wazuh security advisories before rollout.

3. Long-term hardening. Enforce strict canonicalization and allowlisting on all internal RPC file parameters — filenames must resolve within a fixed list directory and match an expected pattern. Apply defense-in-depth so that CDB handlers cannot reference files outside their designated path even if REST/RBAC validation is bypassed. Reduce the privileges of cluster worker processes to the minimum required. Enable integrity monitoring on rbac.db and the CDB list directory. Maintain network segmentation and least-privilege RBAC so that a worker compromise does not translate into master-side file read/delete capability.

References

• NVD — CVE-2026-74033: https://nvd.nist.gov/vuln/detail/CVE-2026-74033
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• MITRE ATT&CK T1485 — Data Destruction: https://attack.mitre.org/techniques/T1485/
• Wazuh project security advisories (vendor advisory channel): https://wazuh.com/

No public exploit, PoC, or Nuclei template is available for CVE-2026-74033 in the provided data. The vulnerability is not listed in CISA KEV, and no named threat actor campaigns or confirmed exploit-in-the-wild activity have been reported. EPSS has not yet been scored by FIRST.org.