Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61783— Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key

Quick assessment

Affected
wazuh wazuh
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Wazuh是美国Wazuh公司开源的一款安全检测与威胁分析平台。 Wazuh 4.14.0版本至4.14.6版本存在安全漏洞，该漏洞源于更新配置RBAC规则（包括显式拒绝）会禁用敏感值掩码逻辑，可能导致经身份验证的低权限用户读取集群密钥。

CVSS 7.0 · High EPSS 0.41% · P33

Possible ATT&CK Techniques 1 AI

T1213.003 · Code Repositories

Affected Version Matrix 1

VendorProduct Version RangeStatus
wazuh wazuh >= 4.14.0, < 4.14.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61783

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key
Source: CVE Program / CVE List V5
Vulnerability Description
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is disabled by any update-config RBAC rule, including an explicit deny. The mask_sensitive_config() decorator applies masking only when _has_update_permissions() returns false, but that gate treats a user as able to update the config whenever a  manager:update_config  or  cluster:update_config  rule exists, without ever checking whether the rule's effect is allow or deny. Because a deny rule is stored as a real entry, a read-only account that is hardened by explicitly denying config edits is counted as having update permission, which turns masking off. A single authenticated GET request to the configuration endpoint with  raw=true  then returns the verbatim ossec.conf XML with  cluster.key  in clear, whereas an otherwise identical account without the deny rule sees the value masked. This issue is fixed in version 4.14.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Wazuh 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Wazuh是美国Wazuh公司开源的一款安全检测与威胁分析平台。 Wazuh 4.14.0版本至4.14.6版本存在安全漏洞，该漏洞源于更新配置RBAC规则（包括显式拒绝）会禁用敏感值掩码逻辑，可能导致经身份验证的低权限用户读取集群密钥。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
wazuh wazuh >= 4.14.0, < 4.14.7 -

II. Public POCs for CVE-2026-61783

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61783

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-61783 (1)

Vendor Advisories for CVE-2026-61783 (1)

Same Patch Batch · wazuh · 2026-08-27 · 6 CVEs total

CVE-2026-61800 9.1 CRITICAL Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fi
CVE-2026-54083 8.1 HIGH Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and
CVE-2026-54085 7.1 HIGH Wazuh: Missing input validation in multiple active response scripts allows argument inject
CVE-2026-61802 6.5 MEDIUM Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/co
CVE-2026-54084 5.3 MEDIUM Wazuh agent enrollment NULL pointer dereference via malformed manager response

IV. Related Vulnerabilities

Same product: wazuh
Same vendor: wazuh
Same weakness: CWE-200

V. Comments for CVE-2026-61783

No comments yet

Leave a comment