Vulnerability Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, a privilege escalation vulnerability exists in the Wazuh Manager's cluster synchronization protocol. The `wazuh-clusterd` service allows authenticated nodes to write arbitrary files to the manager’s file system with the permissions of the `wazuh` system user. Due to insecure default permissions, the `wazuh` user has write access to the manager's main configuration file (`/var/ossec/etc/ossec.conf`). By leveraging the cluster protocol to overwrite `ossec.conf`, an attacker can inject a malicious `<localfile>` command block. The `wazuh-logcollector` service, which runs as root, parses this configuration and executes the injected command. This chain allows an attacker with cluster credentials to gain full Root Remote Code Execution, violating the principle of least privilege and bypassing the intended security model. Version 4.14.3 fixes the issue.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wazuh | Wazuh | >= 3.9.0, < 4.14.3 |
Related Weaknesses (CWE)
References
- https://github.com/wazuh/wazuh/security/advisories/GHSA-r4f7-v3p6-79jmExploitVendor AdvisoryMitigation
FAQ
What is CVE-2026-25770?
CVE-2026-25770 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, a privilege escalation vulnerability exists in the ...
How severe is CVE-2026-25770?
CVE-2026-25770 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-25770?
Check the references section above for vendor advisories and patch information. Affected products include: Wazuh Wazuh.