CVE-2026-44901
HighCVSS 8.4Summary
Wazuh from 4.0.0 to 4.14.6 and 5.0.0-beta2 has a vulnerability in AffectedItemsWazuhResult.merge() in framework/wazuh/core/results.py that trusts the sort_casting field in a cluster worker's JSON response. During distributed API merge, attacker-controlled type names are resolved through Python builtins without an allowlist. A compromised worker can set sort_casting to exec and place Python source in affected_items, causing the master to execute the payload as root when responses from multiple nodes are merged. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
Risk Assessment
An attacker with access to a cluster worker can achieve remote code execution with root privileges on the master server, leading to full compromise of the Wazuh platform.
Recommendation
Immediately upgrade Wazuh to version 4.14.6 or 5.0.0-beta2 to remediate the vulnerability.
Original NVD description (English source)
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge() in framework/wazuh/core/results.py trusts the sort_casting field in a cluster worker's JSON response. During a distributed API merge, attacker-controlled type names are resolved through Python builtins without an allowlist. A compromised worker can set sort_casting to exec and place Python source in affected_items, causing the master to execute the payload as root when responses from multiple nodes are merged. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.