CVE-2026-93347

Executive Summary

CVE-2026-93347 is a path traversal vulnerability (CWE-22) in the Wazuh security platform, affecting versions from 4.1.1 through 4.14.7. The flaw resides in the get_list_file helper, which fails to validate filename values supplied through DistributedAPI requests, allowing a malicious cluster worker that holds the cluster key to read arbitrary files readable by the Wazuh process. Successful exploitation enables disclosure of highly sensitive material including client.keys and ossec.conf containing the cluster key, which can further compromise the Wazuh deployment.

Technical Analysis

Wazuh is an open-source security platform that combines SIEM and XDR capabilities. Its architecture relies on a manager node and one or more worker nodes that communicate over a cluster, authenticated with a shared cluster key. DistributedAPI (often referred to as DAPI) is the internal request-routing mechanism through which cluster components issue operations to one another. The affected component is the get_list_file helper, a utility function used to read file contents (for example, list or configuration files) on behalf of a DistributedAPI request.

The vulnerability is a classic path traversal (CWE-22, commonly known as directory traversal). The get_list_file helper does not validate or sanitize the filename value it receives. Because the filename is attacker-controllable through a DistributedAPI request, an attacker can supply a path containing traversal sequences to escape the intended directory and reference files elsewhere on the filesystem. The result is arbitrary file read within the permissions of the Wazuh process.

Two preconditions are important for exploitation:

1. Cluster key possession. The attacker must hold the cluster key so that the worker-to-manager (or manager-to-worker) request is authenticated and accepted. This places the vulnerability primarily in the post-compromise or malicious-insider category rather than the unauthenticated remote category. A compromised worker node or leaked cluster key is the typical entry point.
2. Wazuh-readable file access. The files that can be read are limited to those the Wazuh process account is permitted to read. The NVD description specifically calls out client.keys, ossec.conf (with the cluster key), and "other Wazuh-readable files."

The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, yielding a base score of 4.9 (Medium). Note that the attack vector is Network (the cluster communicates over the network), attack complexity is Low (no special conditions beyond key possession), privileges required are High (the cluster key acts as a high-privilege credential in this context), user interaction is None, scope is Unchanged, and the impact is a High confidentiality loss with no integrity or availability impact.

Because no public proof-of-concept, exploit code, or Nuclei template has been released for this CVE, and because the NVD description does not disclose the precise request format, parameter names, or exact traversal encoding used by the get_list_file helper, this report deliberately avoids speculating on those specifics. The technical mechanism above is derivable directly from the CWE classification and the description's statement that "unvalidated filename values" are passed through DistributedAPI requests.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the facts provided in the NVD description. No specific function names, endpoints, or parameter names beyond those appearing in the description (get_list_file, DistributedAPI, client.keys, ossec.conf, "cluster key") are asserted.

1. Reconnaissance / target identification. An attacker first obtains a foothold in a Wazuh cluster. This typically means compromising a cluster worker node or otherwise acquiring the cluster key, which is required to authenticate DistributedAPI traffic. Reconnaissance focuses on identifying Wazuh instances running affected versions (4.1.1 through 4.14.7) with an active cluster configuration.

2. Triggering the traversal flaw. With the cluster key in hand, the attacker crafts a DistributedAPI request that invokes the get_list_file helper and supplies a filename value containing directory traversal sequences. Because the helper does not validate the filename, the path resolves outside the intended directory. No user interaction is required; the request is processed programmatically by the cluster machinery.

3. Payload / execution method (vulnerability-class level). The "payload" here is the traversal-bearing filename parameter. The attacker aims the path at sensitive files. At the vulnerability-class level, path traversal payloads use relative directory references to step up out of the base directory, or use absolute paths where translation is not enforced. The NVD description confirms that the helper accepts "unvalidated filename values," meaning traversal or absolute path references are not filtered. The exact encoding used is not specified in the available data and is therefore not asserted here.

4. Post-exploitation impact. The attacker reads arbitrary files accessible to the Wazuh process. Of particular sensitivity are client.keys (which holds agent authentication keys) and ossec.conf, which contains the cluster key. Disclosure of the cluster key or the agent keys can enable lateral movement and deeper compromise of the Wazuh deployment — for instance, impersonating agents or expanding control across the cluster. The CVSS confidentiality impact is High, with no integrity or availability impact.

Impact Assessment

The direct impact is unauthorized disclosure of files readable by the Wazuh process. The most damaging disclosures named in the description are client.keys and ossec.conf containing the cluster key. Possession of these secrets can be leveraged for further compromise of the Wazuh environment, including agent impersonation and cluster-wide control, which elevates the real-world consequence beyond a simple single-file read.

From a CVSS perspective:

• Confidentiality: High — the flaw enables reading of sensitive secrets.
• Integrity: None — no file modification capability is described.
• Availability: None — no denial of service is described.
• Privileges Required: High — exploitation requires the cluster key, a privileged credential.
• Attack Vector: Network, Complexity: Low, User Interaction: None, Scope: Unchanged.

The base score of 4.9 (Medium) reflects the high privilege prerequisite. Blast radius is bounded by which files the Wazuh process can read, but because Wazuh configuration and key material are in scope, the effective blast radius within a compromised cluster can be significant. Organizations running Wazuh 4.1.1 through 4.14.7 with cluster mode enabled are affected. The lack of any CISA KEV listing and absence of public exploit code indicate the vulnerability is not currently known to be exploited in the wild.

Detection Guidance

Sigma Rule

title: Wazuh Path Traversal in get_list_file via DistributedAPI
id: 7f1c4a2e-9b3d-4c5a-8e21-0d6b9a3f5c14
status: experimental
description: Detects path traversal sequences in DistributedAPI requests targeting the Wazuh get_list_file helper (CVE-2026-93347).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93347
author: valtersit.com
date: 2026/01/01
logsource:
  product: wazuh
  service: cluster
detection:
  selection_traversal:
    message|contains:
      - '../'
      - '..\\'
      - '%2e%2e%2f'
      - '%2e%2e%5c'
  selection_target:
    message|contains:
      - 'get_list_file'
      - 'client.keys'
      - 'ossec.conf'
  condition: selection_traversal and selection_target
falsepositives:
  - Legitimate administrative file operations referencing parent directories
level: high

YARA Rule

rule CVE_2026_93347_Wazuh_PathTraversal
{
    meta:
        description = "Detects path traversal payloads targeting the Wazuh get_list_file helper (CVE-2026-93347)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93347"
        severity = "high"

    strings:
        $dapi = "DistributedAPI" ascii wide nocase
        $helper = "get_list_file" ascii wide nocase
        $trav1 = "../" ascii wide
        $trav2 = "..\\" ascii wide
        $trav3 = "%2e%2e%2f" ascii wide nocase
        $trav4 = "%2e%2e%5c" ascii wide nocase
        $target1 = "client.keys" ascii wide nocase
        $target2 = "ossec.conf" ascii wide nocase

    condition:
        ($helper or $dapi) and any of ($trav*) and any of ($target*)
}

Suricata IDS Rule

alert tcp any any -> any 1516 (msg:"CVE-2026-93347 Wazuh get_list_file path traversal attempt"; flow:established,to_server; content:"get_list_file"; http_client_body; nocase; content:"../"; http_client_body; distance:0; nocase; reference:cve,2026-93347; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-93347; classtype:attempted-recon; sid:202693347; rev:1;)

Note on the Suricata rule: the Wazuh cluster protocol is not standard HTTP, so http_client_body may not match in all deployments. The rule is provided as a network-level detection pattern; tuning to the actual cluster protocol buffer (for example, using dce_stub_data or raw content on port 1516, the default Wazuh cluster port) is recommended in production.

Elastic Detection

sequence by host.name
  [ file where event.action == "access" and file.path : ("*client.keys*" or "*ossec.conf*") ]
  [ network where destination.port == 1516 and process.name : "*wazuh*" ]

Note: In environments without a dedicated Wazuh file-access integration, tune this EQL to process or network events emitted by the Wazuh manager. Where DistributedAPI request logs are collected, replace the file conditions with a string contains check on the request payload for get_list_file combined with traversal sequences.

Splunk SPL Query

index=wazuh sourcetype=wazuh:cluster OR sourcetype=wazuh:api
| search (message="*get_list_file*" OR message="*DistributedAPI*")
| search (message="../" OR message="..\\" OR message="%2e%2e%2f" OR message="%2e%2e%5c")
| search (message="*client.keys*" OR message="*ossec.conf*" OR message="*../*")
| stats count values(message) as payloads by host, src_ip, user
| where count > 0

Wazuh OSSEC Rule

<group name="wazuh,cve-2026-93347,">
  <rule id="100347" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">get_list_file</field>
    <field name="message">\.\./</field>
    <description>CVE-2026-93347: Possible path traversal attempt against Wazuh get_list_file helper</description>
    <mitre>
      <id>T1083</id>
    </mitre>
  </rule>

  <rule id="100348" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">get_list_file</field>
    <field name="message">client\.keys|ossec\.conf</field>
    <description>CVE-2026-93347: get_list_file targeting sensitive Wazuh key/config files</description>
    <mitre>
      <id>T1083</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No CISA KEV listing, no vendor fix URL, and no workarounds were provided in the source data. The NVD description states the fix boundary is "before 4.14.8," which implies 4.14.8 resolves the issue, but no tracked source confirms a formal patch release or advisory — treat this as the version boundary rather than a verified patch reference.

1. Immediate mitigations (before an upgrade is possible):

   • Restrict network access to the Wazuh cluster port (default 1516) so that only legitimate cluster members can communicate with the manager and workers. Use host firewalls and network segmentation to prevent untrusted hosts from reaching cluster endpoints.
   • Rotate the cluster key and, where feasible, client.keys if there is any suspicion that a worker has been compromised. Treat the cluster key as a high-value secret; possession is the primary prerequisite for exploitation.
   • Enforce least privilege on the Wazuh process account so it cannot read files outside its intended configuration directories, limiting the set of files an attacker could reach even if traversal succeeds.
   • Monitor DistributedAPI and cluster logs for traversal sequences and references to sensitive filenames as described in the Detection Guidance section.
   • Where an intermediary/API gateway or reverse proxy fronts Wazuh services, consider normalizing or rejecting filenames containing traversal sequences as a compensating control.

2. Patch / upgrade steps:

   • Upgrade Wazuh to 4.14.8 or later, which the NVD description identifies as the first unaffected version.
   • Because no vendor advisory was supplied in the source data, consult the official Wazuh release notes and security advisories for the authoritative upgrade procedure and any additional fixed issues.
   • After upgrading, verify the installed version on manager and all workers, and confirm cluster mode is functioning as expected.

3. Long-term hardening:

   • Treat cluster keys and agent keys as crown-jewel secrets. Implement key rotation schedules, store secrets in a managed secrets store where possible, and restrict read access to client.keys, ossec.conf, and related files.
   • Apply secure coding practices for file-path handling: canonicalize paths, reject traversal sequences, and validate filenames against an allowlist before any file read operation in get_list_file and similar helpers.
   • Adopt defense-in-depth: run Wazuh components with the minimum filesystem permissions required, monitor for anomalous file-access patterns, and integrate cluster and API logs into the SIEM with the detection rules above.
   • Track Wazuh security advisories and CVEs as part of routine vulnerability management; this CVE has no KEV status or public exploit, but early patching remains the most reliable remediation.

References

• NVD — CVE-2026-93347: https://nvd.nist.gov/vuln/detail/CVE-2026-93347
• MITRE CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1083 — File and Directory Discovery: https://attack.mitre.org/techniques/T1083/
• Wazuh official documentation and release notes (consult for authoritative upgrade guidance; verify the 4.14.8 release): https://documentation.wazuh.com/
• CISA Known Exploited Vulnerabilities Catalog (verify absence of this CVE): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence were identified in the source data for CVE-2026-93347. EPSS is not yet scored by FIRST.org; no value is fabricated. No public PoC, exploit code, or Nuclei template is available.