Wazuh is a free and open source platform used for threat prevention

CVE-2026-30893 is a path traversal in Wazuh cluster synchronization. In affected wazuh-manager versions >=4.4.0 and <4.14.4, the decompress_files() routine trusts attacker-controlled file paths from a cluster sync archive and joins them into the extraction path without containment checks. A malicious cluster peer can therefore write files outside the intended directory on other cluster nodes, then turn that into code execution by overwriting Python modules Wazuh loads.

The vendor's *impact* rating is understandable, but the operational severity is lower than a typical CRITICAL because the attacker does not get this from the public edge anonymously. They need authenticated cluster-peer position: internal reachability to port 1516/TCP, clustering enabled, and either control of an existing Wazuh node or possession of the shared 32-character cluster key. That is still bad for clustered deployments, especially where the manager runs as root, but it is classic post-compromise lateral movement rather than broad initial access.

Why this verdict

• Start from 9.0, then cut for attacker position: the vendor baseline assumes the technical impact is severe, and it is. But PR:H means the attacker already has a trusted cluster-peer foothold or the shared cluster key, which implies prior compromise or secret theft.
• Cluster-only narrows the reachable population: this is irrelevant to single-node managers. Only Wazuh clusters with versions 4.4.0 through 4.14.3 and active cluster synchronization are actually in scope.
• Internal service reachability compounds the friction: the path runs over cluster port 1516/TCP, an east-west management plane that competent segmentation or security groups should already restrict. That is very different from an unauthenticated internet-facing login page bug.
• Blast radius keeps it out of MEDIUM: once a malicious peer is trusted, the attacker can write files onto other Wazuh nodes and reach Wazuh-context RCE. In root-run or containerized deployments, that can become full host compromise and cluster-wide lateral movement.

Why not higher?

There is no verified KEV listing, no authoritative evidence of active exploitation, and EPSS is tiny. More importantly, the exploit chain assumes a prior breach stage: internal network position plus authenticated cluster trust. That is exactly the kind of compounding friction that should drag a vendor CRITICAL down operationally.

Why not lower?

This is still arbitrary file write leading to code execution on a central security platform. If one Wazuh node or the cluster key is lost, the bug gives the attacker an efficient path to spread across the rest of the cluster, which is too consequential for a MEDIUM or backlog-only label.

1. Fence port 1516 — Restrict 1516/TCP to explicit Wazuh peer IPs or security groups only, and remove any broad east-west or internet exposure. For a HIGH verdict, deploy this compensating control within 30 days.
2. Disable unused clustering — If a manager is not intentionally part of an HA/distributed Wazuh cluster, disable the <cluster> function entirely so the vulnerable path is unreachable. For a HIGH verdict, complete this within 30 days on any single-node managers carrying cluster config drift.
3. Run Wazuh as least privilege — Make sure the manager does not run as root unless there is a hard dependency, especially in Docker or Kubernetes deployments. This does not remove the bug, but it materially reduces the post-write blast radius; apply within 30 days.
4. Rotate cluster secrets after node compromise — Treat the cluster key as a lateral-movement credential. If any Wazuh node is suspected compromised, rotate the shared cluster key and re-establish trust on clean nodes within 30 days, or immediately as part of incident response.
5. Alert on Wazuh-origin file writes — Add EDR/FIM detections for Wazuh processes writing into /var/ossec/etc/, Wazuh Python/module paths, /etc/cron.d/, /root/.ssh/, and other non-routine locations. Stand up these detections within 30 days so exploitation attempts are not silent.

Run this on each Wazuh manager node, not from an auditor workstation. Invoke it as sudo bash ./check-cve-2026-30893.sh; it needs permission to execute /var/ossec/bin/wazuh-control and read /var/ossec/etc/ossec.conf. It returns VULNERABLE when the node is on an affected version *and* cluster mode appears enabled, PATCHED when the installed version is outside the affected range or fixed, and UNKNOWN when the version is affected but cluster exposure cannot be confirmed cleanly.

#!/usr/bin/env bash
# check-cve-2026-30893.sh
# Detect practical exposure to CVE-2026-30893 on a Wazuh manager node.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

FIXED_VERSION="4.14.4"
AFFECTED_FLOOR="4.4.0"
WAZUH_CONTROL="/var/ossec/bin/wazuh-control"
OSSEC_CONF="/var/ossec/etc/ossec.conf"
OSSEC_INIT="/var/ossec/etc/ossec-init.conf"

say() { printf '%s\n' "$1"; }

normalize_version() {
  # Strip leading v and any suffix like -rc1 or distro release.
  echo "$1" | sed -E 's/^v//; s/[^0-9.].*$//' | awk -F. '{print $1 "." $2 "." $3}'
}

version_ge() {
  # returns 0 if $1 >= $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

version_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ] && [ "$1" != "$2" ]
}

get_version() {
  local raw=""

  if [ -x "$WAZUH_CONTROL" ]; then
    raw="$($WAZUH_CONTROL info -v 2>/dev/null | head -n1)"
    if [ -n "$raw" ]; then
      normalize_version "$raw"
      return 0
    fi
  fi

  if command -v rpm >/dev/null 2>&1; then
    raw="$(rpm -q --qf '%{VERSION}\n' wazuh-manager 2>/dev/null | head -n1)"
    if [ -n "$raw" ] && [ "$raw" != "package wazuh-manager is not installed" ]; then
      normalize_version "$raw"
      return 0
    fi
  fi

  if command -v dpkg-query >/dev/null 2>&1; then
    raw="$(dpkg-query -W -f='${Version}\n' wazuh-manager 2>/dev/null | head -n1)"
    if [ -n "$raw" ]; then
      normalize_version "$raw"
      return 0
    fi
  fi

  if [ -r "$OSSEC_INIT" ]; then
    raw="$(grep -E '^VERSION=' "$OSSEC_INIT" 2>/dev/null | head -n1 | cut -d'=' -f2 | tr -d '"')"
    if [ -n "$raw" ]; then
      normalize_version "$raw"
      return 0
    fi
  fi

  return 1
}

cluster_enabled() {
  # Best-effort XML check without external parsers.
  # Returns:
  # 0 = cluster appears enabled
  # 1 = cluster appears disabled or absent
  # 2 = cannot determine

  [ -r "$OSSEC_CONF" ] || return 2

  if ! grep -qi '<cluster>' "$OSSEC_CONF"; then
    return 1
  fi

  # Extract the first cluster block, if present.
  local block
  block="$(awk 'BEGIN{inblk=0} /<cluster>/{inblk=1} {if(inblk) print} /<\/cluster>/{if(inblk){exit}}' "$OSSEC_CONF" 2>/dev/null)"

  [ -n "$block" ] || return 2

  if echo "$block" | grep -Eqi '<disabled>\s*yes\s*</disabled>'; then
    return 1
  fi

  if echo "$block" | grep -Eqi '<disabled>\s*no\s*</disabled>'; then
    return 0
  fi

  # If a cluster block exists and no explicit disabled flag is present,
  # Wazuh docs indicate default is not disabled.
  return 0
}

main() {
  local ver=""
  if ! ver="$(get_version)"; then
    say "UNKNOWN - could not determine installed Wazuh manager version"
    exit 2
  fi

  if ! echo "$ver" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
    say "UNKNOWN - unparsable Wazuh version: $ver"
    exit 2
  fi

  # Outside affected range => patched/not affected.
  if version_lt "$ver" "$AFFECTED_FLOOR"; then
    say "PATCHED - installed version $ver is below affected range $AFFECTED_FLOOR"
    exit 0
  fi

  if version_ge "$ver" "$FIXED_VERSION"; then
    say "PATCHED - installed version $ver is at or above fixed version $FIXED_VERSION"
    exit 0
  fi

  # Affected version range; now assess practical exposure via cluster mode.
  if cluster_enabled; then
    say "VULNERABLE - affected version $ver and cluster mode appears enabled"
    exit 1
  else
    rc=$?
    if [ "$rc" -eq 1 ]; then
      say "UNKNOWN - affected version $ver but cluster mode appears disabled or absent"
      exit 2
    fi
    say "UNKNOWN - affected version $ver and cluster configuration could not be determined"
    exit 2
  fi
}

main "$@"

Sources

1. NVD CVE-2026-30893
2. Wazuh GitHub Security Advisory GHSA-m8rw-v4f6-8787
3. Wazuh v4.14.4 release notes
4. Wazuh PR #34464 Improve cluster file sync path handling
5. Wazuh cluster configuration reference
6. Wazuh cluster nodes configuration
7. Wazuh wazuh-control tool reference
8. CISA Known Exploited Vulnerabilities Catalog