Vulnerability · Published Aug 18, 2026 · Assigned by VulnCheck

CVE-2026-74044Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello

Medium 6.5

In plain English

A medium-severity path traversal in wazuh-manager from Wazuh. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.6%top 51.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a malicious node name and disconnect, triggering the master's peer cleanup routine to remove the contents of arbitrary directories within the Wazuh installation path writable by the wazuh user.

Affected products (as reported)

Vendor	Product	Versions
Wazuh	wazuh-manager	4.0.0 – before 4.14.6

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

References

GitHub Security Advisory (GHSA-f34r-fcjf-qx6j) vendor-advisory
Pull Request patch
https://www.vulncheck.com/advisories/wazuh-path-traversal-arbitrary-directory-deletion-via-cluster-hello third-party-advisory