Multiple vulnerabilities affecting Wazuh

This solution is affected by several vulnerabilities labeled as follows: CVE-2026-25770: This vulnerability arises from a weakness in the wazuh-clusterd service, responsible for synchronization between cluster nodes. Exploitation of this vulnerability would allow an authenticated attacker to overwrite the /var/ossec/etc/ossec.conf configuration file and execute arbitrary code remotely with root privileges. It is classified critical with a severity score of 9.1 according to CVSS v3.1. CVE-2026-25769: This vulnerability results from an insufficiency in the deserialization of unreliable data within the cluster communication protocol. Exploitation of this vulnerability would allow a malicious actor who has compromised a worker node to execute remote commands with root privileges on the master node. It is classified critical with a severity score of 9.1 according to CVSS v3.1. CVE-2026-25771: This vulnerability is caused by a blocking call in Wazuh API authentication, where a synchronous function performing input/output operations is executed in an asynchronous event loop. Exploitation of this vulnerability would allow an unauthenticated malicious actor to flood the API with requests in order to cause a denial of service. It is classified as medium with a severity score of 5.3 according to CVSS v3.1. CVE-2026-25772: This vulnerability results from a buffer size calculation error in the wdb database synchronization module. Exploitation of this vulnerability would allow an attacker to cause a stack-based buffer overflow, potentially leading to a denial of service or potentially remote code execution. It is classified as medium with a severity score of 4.9 according to CVSS v3.1. CVE-2026-25790: This vulnerability arises from insecure use of the sprintf function in the Security Configuration Assessment (SCA) decoder. Exploitation of this vulnerability would allow an attacker to send a crafted JSON event to cause a stack-based buffer overflow, potentially leading to a denial of service or remote code execution. It is classified as medium with a severity score of 4.9 according to CVSS v3.1.

• CVE-2026-25770, CVE-2026-25769, CVE-2026-25790: Wazuh versions from 3.9.0 to 4.14.2;
• CVE-2026-25771: Wazuh versions from 4.3.0 to 4.14.2;
• CVE-2026-25772: Wazuh versions from 4.4.0 to 4.14.2;

RECOMMENDED ACTIONS:

• Limit access to the wazuh-clusterd service to trusted nodes only;
• Update Wazuh to version 4.14.3 or later;
• Renew the cluster key and allocate all tokens/API keys following the update;