CVE-2026-44901

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44901
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44901.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44901
Aliases
  • GHSA-8c6v-7g3w-prrq
Published
2026-08-19T16:12:12Z
Modified
2026-09-17T03:46:42Z
Severity
  • 8.4 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
Details

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge() in framework/wazuh/core/results.py trusts the sort_casting field in a cluster worker's JSON response. During a distributed API merge, attacker-controlled type names are resolved through Python builtins without an allowlist. A compromised worker can set sort_casting to exec and place Python source in affected_items, causing the master to execute the payload as root when responses from multiple nodes are merged. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-502"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44901.json"
}
References

Affected packages

Git / github.com/wazuh/wazuh

Affected ranges

Type
GIT
Repo
https://github.com/wazuh/wazuh
Events
Introduced
8c2c62a6e9dcbcf2c792f7924e8cfdb26842820b
Fixed
44c2925b46bd058d2426bd44ed1b3e5d7b7b03b4
Introduced
cddd833300cb5af494ba7dab31192bae649eb184
Fixed
b29849f8abb08d78f257e6106b6111a8a1b0e621
Fixed
b58b3b2552497639b1b2a2b23e8de87e4ce9cf02
Database specific
Show details 
{
    "cpe":  [
        "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:wazuh:wazuh:5.0.0:beta1:*:*:*:*:*:*",
        "cpe:2.3:a:wazuh:wazuh:5.0.0:beta2:*:*:*:*:*:*"
    ],
    "extracted_events":  [
        {
            "introduced":  "4.0.0"
        },
        {
            "fixed":  "4.14.6"
        },
        {
            "introduced":  "5.0.0-beta1"
        },
        {
            "last_affected":  "5.0.0-beta1"
        },
        {
            "introduced":  "5.0.0-beta2"
        },
        {
            "last_affected":  "5.0.0-beta2"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

5.*
5.0.0-beta1
5.0.0-beta2
v5.*
v5.0.0-beta1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44901.json"