CVE-2026-30893
CriticalSummary
W Wazuh, od wersji 4.4.0 do przed wersją 4.14.4, występuje podatność typu path traversal w procedurze synchronizacji klastra, która pozwala uwierzytelnionemu uczestnikowi klastra na zapisanie dowolnych plików poza zamierzonym katalogiem na innych węzłach klastra. Może to prowadzić do wykonania kodu w kontekście usługi Wazuh poprzez nadpisanie modułów Pythona używanych przez komponenty Wazuh.
Risk Assessment
W środowiskach, w których demon klastra działa z podwyższonymi uprawnieniami, istnieje ryzyko kompromitacji systemu na poziomie systemowym. To może prowadzić do poważnych naruszeń bezpieczeństwa w organizacji.
Recommendation
Zaleca się aktualizację Wazuh do wersji 4.14.4 lub nowszej, aby usunąć tę podatność. Dodatkowo, warto przeanalizować uprawnienia demona klastra, aby zminimalizować ryzyko w przyszłości.
Related vulnerabilities
- CVE-2026-95606Critical
Deserialization of untrusted data vulnerability in The Events Calendar plugin allows object injection. Affects versions up to 6.17.4.
- CVE-2026-95605Critical
SQL injection vulnerability in WP Data Access allows blind SQL injection. Affects versions up to 5.5.82.
- CVE-2026-76501Critical
Vulnerability in SRv6 OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM and SRv6 features are enabled.
- CVE-2026-76500Critical
A security review in Cisco APIC revealed multiple vulnerabilities related to improper control of a resource through its lifetime (CWE-664). These have been addressed in hardening releases.
- CVE-2026-76499Critical
A security review in Cisco APIC revealed multiple vulnerabilities related to improper neutralization issues (CWE-707). These have been addressed in hardening releases.
- CVE-2026-76498Critical
A security review in Cisco APIC revealed multiple vulnerabilities related to improper access control (CWE-284). These have been addressed in hardening releases.
- CVE-2026-76486Critical
Vulnerability in VXLAN OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM is enabled.
- CVE-2026-76485Critical
Vulnerability in VXLAN OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM is enabled.
- CVE-2026-76483Critical
A security review in Cisco License On-Prem (formerly SSM On-Prem) revealed multiple vulnerabilities related to insufficiently protected credentials (CWE-522). These have been addressed in hardening releases.
- CVE-2026-76482Critical
A security review in Cisco License On-Prem (formerly SSM On-Prem) revealed multiple vulnerabilities related to improper input verification (CWE-347). These have been addressed in hardening releases.
Original NVD description (English source)
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to before version 4.14.4, a path traversal vulnerability in Wazuh's cluster synchronization extraction routine allows an authenticated cluster peer to write arbitrary files outside the intended extraction directory on other cluster nodes. This can be escalated to code execution in the Wazuh service context by overwriting Python modules loaded by Wazuh components (proof of concept available as separate attachment). In deployments where the cluster daemon runs with elevated privileges, system-level compromise is possible. This issue has been patched in version 4.14.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS