Trailing-Slash Trick in Wazuh MasterHandler Grants Root Access to Compromised Cluster Workers
A critical vulnerability in Wazuh allows compromised cluster workers to overwrite configuration files, granting attackers root access across the entire security infrastructure.
Key points
- Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker.
- Attackers can bypass path validation using a trailing-slash basename technique to overwrite ossec.conf and agent.conf.
- The flaw enables root remote code execution across the manager and every connected agent.
Wazuh cluster workers can overwrite protected configuration files in versions before 4.14.8, creating a critical security risk. The vulnerability, tracked as CVE-2026-74040, allows an attacker who controls a worker node to execute arbitrary code with root privileges across the entire manager and agent network.
How does the vulnerability work?
The flaw resides in the MasterHandler.process_files_from_worker function. Attackers exploit a missing extra_valid enforcement and a trailing-slash basename bypass to overwrite protected files. This arbitrary file overwrite capability targets critical configuration files, specifically ossec.conf and agent.conf, which govern the behavior of the security platform.
What is the scope of impact?
According to the NVD record, the vulnerability affects Wazuh versions from 3.9.0 up to, but not including, 4.14.8. The CVSS score is 9.4, rated as critical. The weakness is classified as CWE-862. Successful exploitation results in root remote code execution, compromising the integrity of the manager and all connected agents.
Is there a confirmed fix?
No fix has been confirmed yet in the provided source material. The affected component is the wazuh-manager. Organizations running versions before 4.14.8 are potentially exposed. There is no indication in the source text that a patch or update has been released to address the arbitrary file overwrite issue.
Questions to ask your suppliers
Security teams should verify whether their Wazuh deployment includes unpatched cluster workers. Ask suppliers if they can isolate worker nodes from critical configuration management processes. Determine if your vendor monitors for unauthorized file changes in configuration directories. Ensure that your incident response plan covers scenarios where internal security tools are compromised. Notify infrastructure leads about the potential for lateral movement from worker nodes to master servers.
What to do and how to stay safe: Wazuh
- Check your Wazuh manager versions immediately to see if they fall within the affected range before 4.14.8.
- Review network traffic between cluster workers and the master node for unusual file transfer patterns.
- Monitor file integrity on ossec.conf and agent.conf for unexpected modifications or permission changes.
- Once the vendor provides an update, prioritize patching the master handler component across all manager nodes.
Step-by-step guide: Vulnerability Scanning: What It Finds and What It Misses
General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Wazuh versions are affected by CVE-2026-74040?
Versions from 3.9.0 before 4.14.8 are affected by this vulnerability.
What can an attacker do with this flaw?
An attacker can achieve root remote code execution across the manager and every agent.
What is the CVSS score for this vulnerability?
The CVSS score is 9.4, rated as critical.
