CVE-2026-61783
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Wazuh versions 4.14.0 through 4.14.6 allow an authenticated low-privilege user to read the cluster secret from the manager configuration. This occurs because the masking logic is disabled by any update-config RBAC rule, including an explicit deny.
Risk Assessment
Exposure of the cluster secret could allow an attacker to compromise inter-node communication and escalate privileges across the Wazuh infrastructure. Breach of configuration confidentiality may lead to further attacks.
Recommendation
Upgrade to version 4.14.7 immediately. Review RBAC rules to ensure deny rules are properly enforced.
Original NVD description (English source)
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is disabled by any update-config RBAC rule, including an explicit deny. The mask_sensitive_config() decorator applies masking only when _has_update_permissions() returns false, but that gate treats a user as able to update the config whenever a manager:update_config or cluster:update_config rule exists, without ever checking whether the rule's effect is allow or deny. Because a deny rule is stored as a real entry, a read-only account that is hardened by explicitly denying config edits is counted as having update permission, which turns masking off. A single authenticated GET request to the configuration endpoint with raw=true then returns the verbatim ossec.conf XML with cluster.key in clear, whereas an otherwise identical account without the deny rule sees the value masked. This issue is fixed in version 4.14.7.