CVE-2026-74044

Medium

Description

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a malicious node name and disconnect, triggering the master's peer cleanup routine to remove the contents of arbitrary directories within the Wazuh installation path writable by the wazuh user.

SeverityMedium

CVSS6.5

Exploit probability—

ProductWazuh

PublishedAug 18, 2026

First seenAug 18, 2026

Weakness typeCWE-22Path traversal

How to fix

Update

wazuh wazuh4.14.6 or later

Patches

github.com/wazuh/wazuh/pull/36460

Vendor advisories

github.com/wazuh/wazuh/security/advisories/GHSA-f34r-fcjf-qx6j

Affected products

Product	Affected versions	Fixed in
wazuh wazuh	4.0.0 ≤ v < 4.14.6	4.14.6

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.