MajorCritical vulnerability

CVE-2026-74033 (CVSS 8.4)

NVD · officialPublished Oct 13, 2026Risk 37/100

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path, bypassing REST validation and RBAC to delete files like rbac.db.

Technical details

CVSS

8.4

AV:AdjacentAC:LowPR:HighUI:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source