CVE-2026-74040

Executive Summary

CVE-2026-74040 is an arbitrary file overwrite vulnerability in Wazuh (versions from 3.9.0 before 4.14.8), specifically in MasterHandler.process_files_from_worker. A cluster worker can exploit a trailing-slash basename bypass combined with missing extra_valid enforcement to overwrite protected master-side files, including ossec.conf and agent.conf. The impact is severe: authenticated cluster workers (H=High privilege required) can achieve root remote code execution across the Wazuh manager and every connected agent, with a CVSS score of 9.1.

Technical Analysis

The vulnerability resides in the Wazuh cluster master/worker communication layer, where the master synchronizes files sent from workers. The affected function is MasterHandler.process_files_from_worker, which is responsible for processing files received from cluster workers. Two flaws combine:

1. Trailing-slash basename bypass: The master's path validation logic for determining the basename of an incoming file can be bypassed by a path segment ending with a trailing slash — the validation likely normalizes or extracts the basename before the final separator, causing the check to evaluate a benign name while the actual write target resolves to a protected path.
2. Missing extra_valid enforcement: The extra_valid mechanism intended to whitelist or restrict which extra files a worker may send is not enforced, allowing a worker to submit files outside the sanctioned set.

Together these allow a compromised or malicious worker node to overwrite protected master configuration files such as ossec.conf (the Wazuh manager configuration) and agent.conf (centralized agent configuration). The CWE classification is CWE-862 (Missing Authorization), consistent with the absent extra_valid enforcement — the master fails to authorize that the worker is permitted to write the requested file target. Because both ossec.conf and the centrally distributed agent.conf are overlays consumed by the manager and pushed to agents, an overwrite yields configuration/command execution controlled by data, not just local code. The CVSS scope is changed (S:C), reflecting that the vulnerable component's compromise escalates to affect the wider cluster including all agents. Attack vector is network (AV:N), complexity low (AC:L), privileges high (PR:H — a worker must already be enrolled/authenticated and controlled), no user interaction (UI:N).

Note: The NVD description does not disclose the exact code path that consumes the overwritten configuration to reach code execution (e.g., command hooks or module invocations). No further implementation specifics are fabricated here. No public PoC, exploit code, or Nuclei template is available; exploitation mechanics are inferred from the vulnerability class of arbitrary protected-file overwrite via missing authorization.

Exploitation Scenarios

No public PoC available; attack chain is inferred from vulnerability class.

1. Reconnaissance / positioning: The attacker must control or compromise a Wazuh cluster worker. This requires either administrator-level access to the cluster (PR:H) or the ability to enroll and operate a worker. Target identification consists of confirming a vulnerable Wazuh version (3.9.0 through pre-4.14.8) and that cluster mode with worker synchronization is enabled.

2. Triggering the flaw class: From the worker side, the attacker initiates the cluster file-synchronization path so the master invokes MasterHandler.process_files_from_worker. The attacker crafts the file metadata/path so the basename validation is bypassed via a trailing-slash segment, and sends a file outside the sanctioned set because extra_valid enforcement is absent. The write target resolves to protected master files — ossec.conf or agent.conf.

3. Overwrite and execution (vulnerability-class level): The arbitrary file overwrite replaces the master's manager configuration (ossec.conf) and/or the centralized agent configuration (agent.conf) with attacker-controlled content. Because these files govern manager and agent behavior, control of their contents yields configuration-driven execution of attacker-specified directives — resulting in root-level remote code execution on the manager and propagation to every agent that consumes agent.conf.

4. Post-exploitation impact: With manager and agent configuration under attacker control, the adversary achieves root RCE across the manager and all managed endpoints — a cluster-wide compromise. This supports persistent control of the entire Wazuh-monitored estate, potential disabling of detection, and lateral movement/impact through the agents.

Impact Assessment

CVSS 9.1 (Critical). Subscores: AV:N (network reachable worker→master channel), AC:L (low complexity, no race/conditions described), PR:H (requires a controlled/an enrolled worker identity), UI:N (no user interaction), S:C (scope changed — master compromise extends to all agents), C:H/I:H/A:H (full confidentiality, integrity, and availability impact across the estate).

Business impact is high: Wazuh is a security monitoring/SIEM/XDR control plane. Overwriting ossec.conf and agent.conf enables, at minimum, disabling or subverting security telemetry across every monitored endpoint, and at worst achieving root RCE on the manager and all agents — turning the security platform into an attacker-controlled distribution channel. Blast radius spans the entire cluster: the manager plus every agent consuming agent.conf. Detection and response capabilities may be impaired precisely when an intrusion is in progress. The changed-scope rating underscores that a single vulnerable master/worker relationship can affect the whole managed fleet.

Detection Guidance

Sigma Rule

title: Wazuh Cluster Arbitrary File Overwrite via process_files_from_worker
id: 9f3c1a72-7404-4cve-9b1e-wazuhclustermaster01
status: experimental
description: Detects suspicious cluster worker file synchronization activity targeting protected master files (ossec.conf / agent.conf) consistent with CVE-2026-74040.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-74040
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  product: wazuh
  service: cluster
detection:
  selection_paths:
    file|endswith:
      - 'ossec.conf'
      - 'agent.conf'
  selection_source:
    action|contains:
      - 'process_files_from_worker'
      - 'extra_valid'
  selection_anomaly:
    file|contains: '//'
  condition: selection_paths and (selection_source or selection_anomaly)
falsepositives:
  - Legitimate cluster file synchronization initiated by administrators
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-74040

YARA Rule

rule CVE_2026_74040_Wazuh_Config_Overwrite
{
    meta:
        description = "Detects references to the vulnerable Wazuh cluster file-processing function and protected config targets"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-74040"
        cve = "CVE-2026-74040"
        date = "2026-01-01"
    strings:
        $fn = "process_files_from_worker" ascii wide
        $ev = "extra_valid" ascii wide
        $c1 = "ossec.conf" ascii wide
        $c2 = "agent.conf" ascii wide
    condition:
        uint16(0) != 0x5A4D and
        filesize < 5MB and
        $fn and
        (any of ($c1, $c2)) and
        $ev
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-74040 Wazuh cluster worker file overwrite attempt (process_files_from_worker)"; flow:established,to_server; content:"process_files_from_worker"; nocase; content:"extra_valid"; nocase; content:"ossec.conf"; nocase; distance:0; within:512; reference:cve,2026-74040; classtype:attempted-admin; sid:202674040; rev:1;)

Elastic Detection

sequence by host.name with maxspan=5m
  [process where event.category == "process" and process.command_line : "process_files_from_worker"]
  [file where event.category == "file" and file.name : ("ossec.conf" or "agent.conf") and event.action : ("modification" or "overwrite" or "write")]

Splunk SPL Query

index=wazuh sourcetype=wazuh:cluster OR source="*cluster*"
| search ("process_files_from_worker" OR "extra_valid" OR "ossec.conf" OR "agent.conf")
| eval suspicious=if((match(_raw,"ossec\.conf|agent\.conf") AND (match(_raw,"process_files_from_worker") OR match(_raw,"extra_valid") OR match(_raw,"//"))),1,0)
| where suspicious=1
| stats count min(_time) as first_seen max(_time) as last_seen values(worker) as workers by host, file, action
| sort - count

Wazuh OSSEC Rule

<group name="wazuh_cluster,cve-2026-74040,">
  <rule id="100740" level="12">
    <decoded_as>json</decoded_as>
    <field name="action">process_files_from_worker</field>
    <regex field="file">ossec\.conf$|agent\.conf$</regex>
    <description>CVE-2026-74040: Cluster worker attempt to overwrite protected master file (possible arbitrary file overwrite).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100741" level="10">
    <decoded_as>json</decoded_as>
    <field name="file">//</field>
    <field name="extra_valid">false|missing</field>
    <description>CVE-2026-74040: Trailing-slash basename bypass / missing extra_valid enforcement observed in cluster file sync.</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is documented in the provided data.

1. Immediate mitigations

   • Restrict who can enroll and operate cluster worker nodes; treat any worker as a high-value trust boundary. Enforce strong authentication and least privilege on cluster membership.
   • Network-segment the cluster communication channel (worker→master) so only known worker hosts can reach the master's cluster port; deny by default.
   • Monitor and alert on writes to ossec.conf and agent.conf, and on process_files_from_worker activity involving those filenames or anomalous trailing-slash paths.
   • Consider disabling cluster file synchronization of extra/config files where operationally feasible until a fix is available.
   • Maintain offline, integrity-checked backups of ossec.conf and agent.conf to enable rapid restoration if overwritten.

2. Patch / upgrade steps

   • No fixed version is identified in the provided data. Affected versions are 3.9.0 through pre-4.14.8. Track the Wazuh project for a release that remediates MasterHandler.process_files_from_worker (target: a version at or above 4.14.8 once released). Do not assume any current version is fixed without vendor confirmation.
   • When a fixed release is available, upgrade the manager and all workers; validate extra_valid and path validation behavior post-upgrade.

3. Long-term hardening

   • Enforce code-level path canonicalization and reject paths with redundant/trailing separators in file-sync handlers. Ensure extra_valid (and equivalent allow-list authorization) is always enforced.
   • Adopt immutable/append-only or change-controlled storage for security-critical configuration so a worker cannot overwrite master config outright.
   • Apply zero-trust principles to cluster peers and continuously audit worker-to-master file transfer activity.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-74040
• Wazuh project (vendor) advisories and release notes: https://wazuh.com / https://github.com/wazuh
• CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV catalog (currently NOT listed for CVE-2026-74040): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaign data: none identified. No exploit-in-the-wild evidence, public PoC, or Nuclei template is available for this CVE at the time of writing.