CVE-2026-48162: 
Wazuh Server vulnerability analysis and mitigation

CVE-2026-48162 is a path traversal vulnerability in Wazuh Manager's Distributed API (DAPI) that allows a cluster peer holding the shared Fernet key to read arbitrary files on the master node and forge administrator REST API tokens offline. The flaw exists in DistributedAPI.send_tmp_file() within framework/wazuh/core/cluster/dapi/dapi.py, where the attacker-controlled tmp_file parameter is joined to WAZUH_PATH using os.path.join without canonicalization or path confinement. Affected versions are Wazuh 4.0.0 through 4.14.5 and 5.0.0-beta1 through 5.0.0-beta2. The vulnerability was reported by researcher moltenbit, published on August 7, 2026, and carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory).

The root cause is classified as CWE-73 (External Control of File Name or Path) and CWE-22 (Path Traversal). In send_tmp_file(), the tmp_file value from the DAPI envelope's f_kwargs is passed directly to os.path.join(common.WAZUH_PATH, self.f_kwargs['tmp_file']) without any realpath check, allow-list validation, or directory confinement. Because Python's os.path.join discards the first argument when the second is an absolute path, an attacker can supply either a relative traversal (e.g., tmp/../api/configuration/security/private_key.pem) or an absolute path (e.g., /etc/passwd) to read any file accessible to the wazuh user. The attack is reachable via a single DAPI request with request_type: "distributed_master" and a crafted f_kwargs.tmp_file field sent over the cluster TCP port (default 1516), authenticated only by the shared Fernet key. A secondary effect is that the os.remove() call at line 419 is never reached due to a TypeError exception at line 415, meaning the target file is read without leaving any on-disk trace (GitHub Advisory, Fix Commit).

Successful exploitation grants an attacker an unconstrained arbitrary file read primitive on the Wazuh master node, limited only by the wazuh user's filesystem permissions. The most critical consequence is exfiltration of /var/ossec/api/configuration/security/private_key.pem (the ES512 REST API signing key), enabling offline forgery of valid administrator JWTs without creating any user account or leaving an audit trail. Additional sensitive files readable include cluster TLS material (/var/ossec/etc/sslmanager.key), REST API TLS keys, agent enrollment keys (/var/ossec/etc/client.keys), and agentless cleartext passwords. With forged admin tokens, the attacker gains full administrative access to the REST API — including agent management, rule/decoder modification, cluster configuration, and user management — and can mint fresh tokens indefinitely until the JWT keypair is explicitly rotated (GitHub Advisory).

A detailed proof-of-concept (PoC) script (c2_poc_v2.py) and a JWT forging script (forge_admin_jwt.py) are publicly available in the GitHub Security Advisory, verified against the official wazuh/wazuh-manager:4.14.5 Docker image. The attack requires only network reachability to the cluster port (TCP/1516) and knowledge of the 32-byte Fernet cluster key — no prior worker registration is needed. The EPSS score is currently 0.0, and the vulnerability is not listed in the CISA KEV catalog as of the time of this report. No threat actor attribution or in-the-wild exploitation has been publicly confirmed, though the vulnerability was noted in threat intelligence aggregators shortly after disclosure (GitHub Advisory, Feedly).

1. Obtain prerequisites: Acquire the 32-byte Fernet cluster key (e.g., from a backed-up ossec.conf, a compromised worker node, or network interception) and ensure TCP/1516 reachability to the Wazuh master.
2. Connect to the cluster port: Using the PoC script, establish a TCP connection to the master on port 1516 and perform the standard cluster handshake by sending a hello message formatted as {NODE_NAME} wazuh worker 4.14.5, encrypted with the Fernet key.
3. Send malicious DAPI request: Transmit a dapi opcode with a crafted JSON envelope containing request_type: "distributed_master", from_cluster: false, and f_kwargs.tmp_file set to a traversal path such as tmp/../api/configuration/security/private_key.pem or an absolute path like /etc/passwd.
4. Capture file contents: Receive the master's asynchronous response, collecting file_upd chunks into a local buffer. The master reads and transmits the target file byte-for-byte; a subsequent dapi_err (WazuhInternalError 1000) confirms the chain executed and the file was not deleted on disk.
5. Exfiltrate the JWT signing key: Target /var/ossec/api/configuration/security/private_key.pem to obtain the ES512 private key (384 bytes on a stock installation).
6. Forge administrator JWT offline: Using forge_admin_jwt.py, sign a JWT payload with sub: "wazuh", rbac_roles: [1], rbac_mode: "white", and exp - nbf = 900 (default auth_token_exp_timeout) using the exfiltrated key and ES512 algorithm.
7. Exercise administrative REST API access: Use the forged token in Authorization: Bearer headers to call admin-only endpoints such as GET /agents, GET /security/users, or configuration modification endpoints on the Wazuh REST API (default port 55000) (GitHub Advisory).

• Network: Unexpected inbound TCP connections to port 1516 (Wazuh cluster port) from unknown or external IP addresses; connections from IPs not corresponding to registered cluster nodes; short-lived connections that perform a handshake and disconnect after a single DAPI exchange.
• Logs: Wazuh cluster logs showing dapi_err or WazuhInternalError(1000) immediately following a dapi request from an unrecognized peer node name; cluster log entries referencing file paths outside /var/ossec/tmp/ in DAPI context; authentication events in the REST API access log with JWT tokens whose nbf timestamps do not correspond to any /security/user/authenticate call.
• File System: No on-disk artifact is created by the read operation (the os.remove is not reached), making filesystem-based detection difficult; however, absence of expected temporary files that should have been cleaned up may indicate anomalous DAPI activity.
• Process/Behavior: REST API administrator actions (agent management, user listing, configuration changes) occurring without a corresponding authentication event in the API access log; forged tokens are structurally identical to legitimate tokens and will not trigger signature validation failures (GitHub Advisory).

Upgrade Wazuh Manager to version 4.14.6 or 5.0.0-beta3, which contain the fix merged via PR #36246. The patch replaces the unsafe os.path.join(common.WAZUH_PATH, tmp_file) with os.path.realpath(os.path.join(common.OSSEC_TMP_PATH, tmp_file)) and enforces that the resolved path starts with OSSEC_TMP_PATH, rejecting traversal sequences and absolute paths. No configuration-based workaround fully mitigates the vulnerability; however, restricting network access to TCP/1516 to only trusted cluster peer IPs via firewall rules reduces the attack surface. If the cluster Fernet key has been exposed, rotate it and also rotate the REST API JWT keypair (via change_keypair()) to invalidate any previously exfiltrated signing keys (Wazuh v4.14.6 Release, Fix PR).

The vulnerability was reported by researcher moltenbit and credited in the official GitHub Security Advisory. Security news outlet SecurityOnline.info covered the broader set of Wazuh manager cluster vulnerabilities shortly after disclosure. A Medium post by Loginsoft discussed active exploitation context around this attack surface. Mastodon security community accounts also noted the advisory. The fix was developed by Wazuh developer vikman90 and merged within approximately two weeks of the internal report (SecurityOnline, Loginsoft Medium).