---
id: CVE-2026-61783
title: >-
  Wazuh is an open-source security platform providing unified XDR and SIEM
  protection for endpoints and cloud workloads
summary: >-
  Wazuh is an open-source security platform providing unified XDR and SIEM
  protection for endpoints and cloud workloads. In versions 4.14.0 through
  4.14.6, an authenticated low-privilege user can read the cluster secret from
  the manager co…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-200
  - CWE-863
vendor: wazuh
product: wazuh
affected:
  - 'wazuh >= 4.14.0, < 4.14.7'
patched:
  - wazuh 4.14.7
published: '2026-08-28'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T19:13:26.400'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61783'
references:
  - url: >-
      https://github.com/wazuh/wazuh/commit/939f2e52afff8fbeb7b0894f3f1417eb6c395db3
    label: security-advisories@github.com
  - url: 'https://github.com/wazuh/wazuh/security/advisories/GHSA-vjcq-cf36-f5gx'
    label: security-advisories@github.com
  - url: 'https://github.com/wazuh/wazuh/security/advisories/GHSA-vjcq-cf36-f5gx'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00239
epssPercentile: 0.15271
ingestedAt: '2026-09-08T21:11:12.286Z'
---

## Overview

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is disabled by any update-config RBAC rule, including an explicit deny. The mask_sensitive_config() decorator applies masking only when _has_update_permissions() returns false, but that gate treats a user as able to update the config whenever a  manager:update_config  or  cluster:update_config  rule exists, without ever checking whether the rule's effect is allow or deny. Because a deny rule is stored as a real entry, a read-only account that is hardened by explicitly denying config edits is counted as having update permission, which turns masking off. A single authenticated GET request to the configuration endpoint with  raw=true  then returns the verbatim ossec.conf XML with  cluster.key  in clear, whereas an otherwise identical account without the deny rule sees the value masked. This issue is fixed in version 4.14.7.

## Affected

- `wazuh >= 4.14.0, < 4.14.7`

## Remediation

Upgrade past the affected range:

- `wazuh 4.14.7`