CVE-2026-44901: Wazuh

High severity, CVSS 8.4. EPSS: 0.7% chance of exploitation in the next 30 days.

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge() in framework/wazuh/core/results.py trusts the sort_casting field in a cluster worker's JSON response. During a distributed API merge, attacker-controlled type names are resolved through Python builtins without an allowlist. A compromised worker can set sort_casting to exec and place Python source in affected_items, causing the master to execute the payload as root when responses from multiple nodes are merged. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

Affected products

• Wazuh Wazuh: from 4.0.0, before 4.14.6 (fixed in 4.14.6); version 5.0.0 only

Published 2026-08-19. Last modified 2026-09-15.