Wazuh manager

Wazuh 4.14.6, two cluster-protocol paths to root that bypass the CVE-2026-25770 fix, a DAPI deserialization RCE, and a pre-auth stack overflow on the enrollment port

Wazuh (the open-source SIEM and XDR platform many public-sector SOCs run themselves) shipped 4.14.6 on 2026-08-06 and 2026-08-07 with ten CVEs, each disclosed as its own advisory, and BSI CERT-Bund independently cross-listed the same identifiers for the same release (BSI CERT-Bund, 2026-08-06). Four carry the operational weight, and two of them matter beyond their scores because they defeat a fix the project already shipped.

CVE-2026-49441 and CVE-2026-48024 are both arbitrary-file-write-to-root primitives in the cluster protocol's master-side file-receive path, and both reach it through sibling code paths that the _ALLOWED_PREFIXES hardening added for CVE-2026-25770 in 4.14.3 does not cover, one through the non-merged branch's unchecked mapping of a peer-supplied key to a destination path, the other through peer-controlled path traversal in the merged-file header line (Wazuh, 2026-08-07, Wazuh, 2026-08-06). Either lets a peer holding the shared Fernet key overwrite ossec.conf and reach root by way of the next wazuh-logcollector reload. CVE-2026-44901 is a deserialization flaw in the distributed API's response-merging function: a compromised worker sets sort_casting to a builtin name that is never allowlisted, and the master resolves and calls it as root, but only when a REST request fans out across two or more nodes, which is the precondition worth remembering during triage (Wazuh, 2026-08-06).

CVE-2026-45798 is the one reachable by anyone. A fixed-size copy in the version-comparison helper never NUL-terminates a maximum-length input, and the out-of-bounds scans that follow crash the daemon; the function sits behind the V: field of an enrollment message to wazuh-authd on TCP/1515, and Wazuh states plainly that the shipped defaults require no credential to get there (Wazuh, 2026-08-06). Every flaw here is researcher-reported with no exploitation claimed by any party.

Detection, telemetry class first. The cluster wire protocol is rarely visible to conventional network inspection, so the durable anchor for the file-write pair is file-integrity state on ossec.conf; an unexpected content or timestamp change followed by a wazuh-logcollector restart is the sequence, not either event alone. For the distributed-API flaw, process-creation telemetry showing the manager's own API or cluster daemon as the parent of a shell or interpreter is anomalous on a healthy cluster, and the necessary condition is a REST request naming more than one node. For the enrollment overflow, repeated short-lived connections to the enrollment port followed by daemon restarts is the crash signature. Triage: legitimate cluster synchronisation writes constantly into each peer's own queue subtree, so file writes by the manager are normal; the discriminator is a write landing outside that subtree, in the configuration directory.