CVE-2026-25769: Wazuh cluster insecure deserialization lets a compromised worker execute commands on the master node

Linha do tempo

1. yokai.hakaisecurity.io ↗ · pub. 17/03/2026 13:51 · coletado 19/10 18:03 primeiro registro

   CVE-2026-25769: Wazuh cluster insecure deserialization lets a compromised worker execute commands on the master node

   ler a análise desta fonte ocultar

   Hakai Security Research Team disclosed CVE-2026-25769, an RCE flaw from insecure deserialization (CWE-502) in the cluster protocol of Wazuh up to version 4.14.1. A compromised worker node can run arbitrary commands on the master node. The researchers reported it through the GitHub Security Advisory program, and the Wazuh team acknowledged it and assigned the CVE. The article does not report exploitation in the wild. The impact is serious because the master holds security logs, agent configurations and detection rules, and can control agents, so a compromise could enable tampering with monitoring data and lateral movement.

   Technical Details

   • The flaw is in as_wazuh_object() in framework/wazuh/core/cluster/common.py. This function is the object_hook for json.loads() and handles messages between cluster nodes.
   • For JSON objects with a __callable__ key, it reads __module__ from attacker-controlled input, calls import_module() with no whitelist, and resolves the function with getattr().
   • dapi.py then runs the returned function with attacker-supplied kwargs, in run_local() as f(**f_kwargs).
   • Attack flow: the compromised worker sends a malicious DAPI request through LocalClient.execute(). The request is encrypted with the cluster Fernet key and sent over TCP to master port 1516. The master deserializes {"__callable__": {"__name__": "getoutput", "__module__": "subprocess"}} and runs subprocess.getoutput with an attacker-chosen command.
   • Prerequisites are access to a compromised worker, which already holds the cluster key and network reach to the master. The PoC wrote /tmp/RCE_PROOF as the wazuh user (uid 999, group root) on the master.
   • Root causes: the cluster design implicitly trusts authenticated nodes, with no module whitelist, no content validation and no sandboxing. The PoC lab used Wazuh manager Docker images 4.9.2.

   Remediation

   • Upgrade Wazuh to the latest released version that contains the fix.
   • Apply least privilege to the Wazuh service so it has only the access it needs.
   • Protect worker nodes and the cluster key, since a compromised worker is the exploitation prerequisite.