CVE-2026-74043

Executive Summary

CVE-2026-74043 is a path traversal vulnerability (CWE-22) in Wazuh versions from 4.1.1 before 4.14.8, affecting the upload_list_file, upload_rule_file, and upload_decoder_file distributed (cluster) worker functions. An attacker holding the Wazuh cluster key can send DistributedAPI requests containing ../ sequences in the filename parameter, bypassing REST controller validation, to write files at arbitrary paths under the wazuh user's privileges. With a CVSS base score of 9.0 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H), the impact is severe: high integrity loss, high availability loss via scope-changing writes outside the security authority, and a low confidentiality impact from the ability to relocate or overwrite files that the wazuh account can read or influence.

Technical Analysis

Wazuh is an open-source security platform comprising a central manager, indexer, dashboard, and distributed "cluster" of worker nodes that synchronize configuration and detection content. The cluster model relies on a shared cluster key that authenticates node-to-node traffic. Within that synchronization path, the manager exposes DistributedAPI endpoints used to upload detection content and supporting files. The three vulnerable functions named in the advisory are upload_list_file, upload_rule_file, and upload_decoder_file — these correspond respectively to uploading list/CDB content, decoder definitions, and rule definitions into the manager.

The defect is a classic path traversal (CWE-22): the filename value accepted by these functions is not adequately normalized or constrained to the intended content directory. By supplying ../ sequences in filename, a malicious cluster worker can escape the designated directory and cause the manager to write the uploaded content at an arbitrary filesystem path. The description explicitly states this traversal bypasses REST controller validation, meaning validation present at the REST layer does not hold for the cluster/DistributedAPI path — the two validation planes are inconsistent, and only one is enforced on the worker-initiated route.

Key characteristics of this vulnerability:

• Authentication requirement (PR:H): The attacker must possess the cluster key. This is a privileged, service-to-service credential, not an end-user credential. Consequently the vulnerability is not remotely exploitable by an anonymous internet actor — the adversary must first be operating within, or have compromised, the cluster trust boundary (a worker node or anything possessing the key).
• Network vector (AV:N): The DistributedAPI request is transmitted over the network between cluster members.
• Scope change (S:C): Because the write can land outside the intended content directory — i.e., outside the vulnerable component's original security authority — the impact crosses a privilege/security boundary, which is why the scope modifier is Changed and the base score is elevated to 9.0.
• Integrity (I:H) and Availability (A:H): Arbitrary write as the wazuh user permits tampering with detection content and other files the wazuh process owns. Overwriting or clobbering rule/decoder/config content can disable detection (availability/integrity of the security monitoring function) and, if a writable file is later executed or consumed by a privileged process, can chain toward code execution.
• Confidentiality (C:L): The direct impact is primarily integrity; confidentiality is scored Low because traversal writes are not a read primitive, though relocation of files may expose content indirectly.

Code-level specifics beyond the three function names (upload_list_file, upload_rule_file, upload_decoder_file), the filename parameter, and the DistributedAPI/REST validation relationship are not present in the supplied description. No stack traces, file paths, or bypass payloads are provided. The public ExploitDB/Nuclei/GitHub sources show no PoC, no Nuclei template, and no weaponized exploit as of this writing.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-22 in the named DistributedAPI upload functions) and the stated preconditions. No specific code patterns or endpoint string formats beyond the three function names are asserted.

1. Precondition — obtain the cluster key. The adversary must first acquire the shared cluster key. Given it is a distributed (service-to-service) credential, this typically implies a prior compromise of a cluster worker node, exposure of cluster configuration, or a leaked key. This is the hard gate: without the key, the DistributedAPI requests cannot authenticate, and the vulnerability is not reachable.

2. Reconnaissance / target identification. Identify Wazuh manager versions in the affected range (4.1.1 to before 4.14.8) and enumerate cluster topology. Identify a manager reachable from a compromised or attacker-controlled worker. Note that the flaw lives in the cluster synchronization surface, not the standard dashboard/REST surface exposed to end users, so reconnaissance must focus on cluster membership and version.

3. Trigger the flaw (vulnerability-class level). Authenticate to the DistributedAPI using the cluster key and invoke upload_list_file, upload_rule_file, or upload_decoder_file (the three affected functions) with a filename value containing ../ traversal sequences. Because REST controller validation does not govern this path, the traversal is not blocked at the controller layer, and the filename is resolved to a path outside the intended content directory. The payload content (the file body) is the attacker's choice and is written as the wazuh user.

4. Post-exploitation impact. Arbitrary write under the wazuh account enables: (a) tampering with or destruction of detection content (rules, decoders, lists) to blind monitoring; (b) overwriting files the wazuh process owns or has write access to; and (c) potential escalation from write to code execution if a traversed-to location is subsequently consumed or executed by a higher-privileged process — a scope-changing (S:C) outcome. Full exploitation details beyond the named functions and the ../ mechanism are not provided and should not be assumed.

Impact Assessment

• Business impact: Wazuh is widely deployed as the SIEM/XDR backbone of enterprise SOCs. A write primitive in the manager's rule/decoder/list upload path directly threatens the integrity and availability of detection capability. An adversary with the cluster key could silently disable or alter detections, undermines compliance evidence, and potentially chain to host compromise.
• Affected systems: Wazuh deployments in the range 4.1.1 through versions before 4.14.8 that operate a cluster with worker nodes. Standalone managers without the distributed upload surface are less exposed, though version eligibility remains.
• Blast radius: Scoped by the cluster boundary and the wazuh user's filesystem permissions. Because of the S:C scope change, the impact extends beyond the intended content directory. Notably, exploitation requires the cluster key, so the effective attack surface is limited to actors who already hold cluster-level trust — but the consequences for those who do are severe (integrity 高, availability high).
• CVSS interpretation: AV:N (network requests), AC:L (no special conditions), PR:H (cluster key required), UI:N (no user interaction), S:C (writes escape the vulnerable component's authority), C:L / I:H / A:H — yield 9.0. The high score reflects the integrity/availability impact and the scope change, tempered only by the privileged authentication requirement.

Detection Guidance

Sigma Rule

title: Wazuh Cluster DistributedAPI Path Traversal File Upload (CVE-2026-74043)
id: 6b2f1a4e-7c9d-4a1b-9e3f-wazuh74043
status: experimental
description: Detects DistributedAPI upload_list_file, upload_rule_file, or upload_decoder_file calls whose filename field contains path traversal sequences, targeting Wazuh 4.1.1 to <4.14.8.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-74043
author: valtersit.com
date: 2026/01/01
logsource:
  product: wazuh
  service: manager
detection:
  selection_func:
    functionname|contains:
      - 'upload_list_file'
      - 'upload_rule_file'
      - 'upload_decoder_file'
  selection_traversal:
    filename|contains:
      - '../'
      - '..\\'
      - '%2e%2e'
      - '..%2f'
  condition: selection_func and selection_traversal
falsepositives:
  - Legitimate cluster synchronization (expected filenames should not contain traversal sequences)
level: critical
tags:
  - attack.t1190
  - attack.t1570
  - cve.2026-74043

YARA Rule

rule CVE_2026_74043_Wazuh_PathTraversal
{
    meta:
        description = "Detects path traversal sequences in Wazuh DistributedAPI upload payloads (CVE-2026-74043)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-74043"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $fn1 = "upload_list_file" ascii wide nocase
        $fn2 = "upload_rule_file" ascii wide nocase
        $fn3 = "upload_decoder_file" ascii wide nocase
        $trav1 = "../" ascii wide
        $trav2 = "..\\" ascii wide
        $trav3 = "..%2f" ascii nocase
        $pname = "filename" ascii wide nocase
    condition:
        ($fn1 or $fn2 or $fn3) and $pname and ($trav1 or $trav2 or $trav3)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-74043 Wazuh DistributedAPI Path Traversal File Upload Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"upload_list_file"|"upload_rule_file"|"upload_decoder_file"; http.request_body; content:"filename"; content:"../" ; classtype:attempted-admin; reference:cve,2026-74043; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-74043; sid:99974043; rev:1;)

Elastic Detection

process where event.type in ("start", "access") and
  process.name : "wazuh-*" and
  process.args : ("upload_list_file", "upload_rule_file", "upload_decoder_file") and
  process.args : "*../*"

Splunk SPL Query

index=wazuh OR index=ossec
| search ("upload_list_file" OR "upload_rule_file" OR "upload_decoder_file")
| search filename="*../*" OR filename="*..%2f*" OR filename="*..\\*"
| stats count min(_time) as first_seen max(_time) as last_seen by host, filename, functionname
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="wazuh,cve-2026-74043,path_traversal,">
  <rule id="100740" level="12">
    <decoded_as>json</decoded_as>
    <field name="functionname">upload_list_file|upload_rule_file|upload_decoder_file</field>
    <field name="filename" type="pcre2">\.\./|\.\.\\|%2e%2e|\.\.%2f</field>
    <description>CVE-2026-74043: Wazuh DistributedAPI upload function called with path traversal sequence in filename.</description>
    <mitre>
      <id>T1190</id>
      <id>T1570</id>
    </mitre>
    <group>cve_2026_74043,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The advisory range indicates fixes targeted at 4.14.8, but no vendor commit, advisory, or verified fix is present in the supplied data. Treat all current deployments as unpatched until a vendor-confirmed release is validated.

1. Immediate mitigations (compensating controls):

   • Rotate the Wazuh cluster key immediately if any suspicion of worker compromise or key exposure exists; treat the cluster key as a high-value secret.
   • Enforce strict network segmentation so that only legitimate cluster members can reach the manager's DistributedAPI/cluster ports; block worker-initiated upload paths from any host not required for synchronization.
   • Add the detection rules above (Sigma/YARA/Suricata/Elastic/Splunk/Wazuh) and alert on any filename containing traversal sequences entering the three affected functions.
   • Reduce the wazuh account's filesystem write scope using OS-level controls (dedicated service account, least-privilege directory permissions, mount options) to limit where a traversal write can land.
   • Audit file integrity of Wazuh rules, decoders, lists, and configuration directories on a schedule (e.g., FIM) to detect unauthorized writes.

2. Patch/upgrade steps:

   • Monitor the Wazuh project for the official fix and an accompanying advisory. The affected range terminates at "before 4.14.8"; verify release notes and changelogs for the specific fix commit before upgrading.
   • Once a vendor-confirmed release is available, stage the upgrade in a non-production cluster, validate rule/decoder synchronization, then roll out to all manager and worker nodes.
   • Verify post-upgrade that the DistributedAPI upload functions reject traversal sequences and that REST controller validation is consistently applied on the cluster path.
   • Do not rely on unofficial builds or unverified "patched" forks; confirm integrity of all binaries and packages.

3. Long-term hardening:

   • Apply a single, shared input-validation library to all paths that accept filenames (REST and DistributedAPI alike) to eliminate validation-plane inconsistencies.
   • Canonicalize and confine every upload to its intended directory (realpath containment checks, reject any resolved path outside the allowlisted root).
   • Implement mutual TLS with per-node cert pinning for cluster traffic and short-lived credentials to reduce the value of a stolen cluster key.
   • Practice least privilege: run the wazuh service with the minimum filesystem surface required.
   • Integrate continuous vulnerability management to detect future enumeration/release updates for this CVE.

References

• NVD — CVE-2026-74043: https://nvd.nist.gov/vuln/detail/CVE-2026-74043
• Wazuh official documentation / release notes (verify 4.14.8 fix and advisory): https://documentation.wazuh.com
• Wazuh GitHub project (track fix commits and changelog): https://github.com/wazuh/wazuh
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: https://cwe.mitre.org/data/definitions/22.html

No public PoC, Nuclei template, or exploit code is available. CISA KEV: not listed. No known threat actor campaign or confirmed exploit-in-the-wild evidence is associated with this CVE in the supplied data.