{"id":"CVE-2026-44252","title":"Wazuh is a free and open source platform used for threat prevention, detection, and response","summary":"Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API user with manager:read permission to retrieve the cluster key from …","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-863"],"vendor":"wazuh","product":"wazuh","affected":["wazuh >= 4.0.0, < 4.14.5"],"patched":["wazuh 4.14.5"],"published":"2026-08-19","updated":"2026-09-18","sourceUpdated":"2026-09-18T14:55:02.240","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44252","references":[{"url":"https://github.com/wazuh/wazuh/commit/b3459f5663702aea14e91330a7a6912081fed2eb","label":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/pull/35307","label":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.5","label":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta3","label":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-34fx-c2xw-xcpg","label":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-34fx-c2xw-xcpg","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00412,"epssPercentile":0.35165,"ingestedAt":"2026-09-09T21:22:45.539Z","slug":"CVE-2026-44252","body":"## Overview\n\nWazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API user with manager:read permission to retrieve the cluster key from the element in ossec.conf through GET /manager/configuration?raw=true. An attacker with network access to TCP port 1516 can use the disclosed Fernet key to impersonate a cluster worker and submit distributed API requests containing attacker-controlled rbac_permissions with rbac_mode set to black. Because the master trusts the worker-supplied authorization context, the attacker can create users, assign administrator roles, access credentials and API tokens, modify configuration, and execute actions across agents. This issue is fixed in version 4.14.5.\n\n## Affected\n\n- `wazuh >= 4.0.0, < 4.14.5`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `wazuh 4.14.5`","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":206878,"id":"CVE-2026-44252","ts":1789746306508,"field":"cvss","old":null,"new":"8.8"},{"seq":206877,"id":"CVE-2026-44252","ts":1789746306508,"field":"severity","old":"none","new":"high"}]}