Remote Code Execution in Wazuh Threat Detection Platform
CVE-2026-44901
What is CVE-2026-44901?
Wazuh, an open-source platform for threat detection, is susceptible to an issue where attacker-controlled type names can be executed through Python builtins. This vulnerability occurs in the AffectedItemsWazuhResult.merge() function when merging distributed API responses from cluster workers that improperly trust the sort_casting field in JSON responses. An attacker can exploit this flaw by manipulating the sort_casting field to execute arbitrary Python code on the master node with root privileges during the merge operation. The issue affects Wazuh versions 4.0.0 to 4.14.6 and 5.0.0-beta2. The vulnerability has been addressed in versions 4.14.6 and 5.0.0-beta2.
Affected Version(s)
wazuh >= 4.0.0, < 4.14.6 < 4.0.0, 4.14.6
wazuh >= 5.0.0-beta1, < 5.0.0-beta2 < 5.0.0-beta1, 5.0.0-beta2