Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-61783— Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key

Quick assessment

Affected
wazuh wazuh
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Wazuh 是一个开源安全平台，为端点和云工作负载提供统一的 XDR 和 SIEM 防护。在 4.14.0 至 4.14.6 版本中，经过身份验证的低权限用户可以读取集群密钥（cluster secret），因为用于屏蔽敏感值的逻辑会被任何 update-config RBAC 规则禁用，包括显式的拒绝规则。 装饰器仅在 返回 时应用屏蔽；然而，该门控机制只要存在 或 规则，就认为用户具备配置更新权限，而从未检查该规则的效果（effect）是允许（allow）还是拒绝（deny）。由于一条“拒绝”规则会作为一个真实

CVSS 7.0 · High

Possible ATT&CK Techniques 1 AI

T1213.003 · Code Repositories
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61783

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key
Source: CVE Program / CVE List V5
Vulnerability Description
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is disabled by any update-config RBAC rule, including an explicit deny. The mask_sensitive_config() decorator applies masking only when _has_update_permissions() returns false, but that gate treats a user as able to update the config whenever a  manager:update_config  or  cluster:update_config  rule exists, without ever checking whether the rule's effect is allow or deny. Because a deny rule is stored as a real entry, a read-only account that is hardened by explicitly denying config edits is counted as having update permission, which turns masking off. A single authenticated GET request to the configuration endpoint with  raw=true  then returns the verbatim ossec.conf XML with  cluster.key  in clear, whereas an otherwise identical account without the deny rule sees the value masked. This issue is fixed in version 4.14.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
wazuh wazuh >= 4.14.0, < 4.14.7 -

II. Public POCs for CVE-2026-61783

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61783

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-61783 (1)

Vendor Advisories for CVE-2026-61783 (1)

Same Patch Batch · wazuh · 2026-08-27 · 6 CVEs total

CVE-2026-61800 9.1 CRITICAL Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fi
CVE-2026-54083 8.1 HIGH Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and
CVE-2026-54085 7.1 HIGH Wazuh: Missing input validation in multiple active response scripts allows argument inject
CVE-2026-61802 6.5 MEDIUM Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/co
CVE-2026-54084 5.3 MEDIUM Wazuh agent enrollment NULL pointer dereference via malformed manager response

IV. Related Vulnerabilities

Same product: wazuh
Same vendor: wazuh
Same weakness: CWE-200

V. Comments for CVE-2026-61783

No comments yet

Leave a comment