InfoSecBulletin Cybersecurity for mankind
Wazuh has fixed a critical issue dubbed CVE-2026-30893 which is rated 9.0 on the CVSS scale allowing an authenticated cluster peer to write arbitrary files outside the intended extraction directory on other cluster nodes. This can be escalated to code execution in the Wazuh service context by overwriting Python modules loaded by Wazuh components.
The flaw is found in Wazuh’s system, especially in the decompress_files() function used for syncing the cluster. When Wazuh cluster nodes share data, they send archives with different setup and operational files.
Contract and server dispute brought down Bangladesh’s digital payment
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
The receiving node takes file paths directly from the incoming archive and passes them to os.path.join() without any normalization or containment checks. A compromised or malicious peer can craft an archive with traversal paths.
When the victim node does the sync, it saves the attacker’s content to the given path, even if it is not in the right sync folder.
Because Wazuh is often tasked with protecting high-value workloads, the impact of this vulnerability depends heavily on the deployment context:
Standard Installations: The daemon usually works as the wazuh user. In this case, an attacker can change Python modules in /var/ossec/wodles/. Since the system runs these modules often, the attacker gets to run code in the Wazuh service.
Docker & Elevated Deployments: In many container setups, the Wazuh program runs as root automatically. This raises the danger of a full system takeover. Attackers can change files in /etc/cron.d/ for scheduled tasks or add their own keys to /root/.ssh/authorized_keys for lasting, high-level access.
While the attack needs the person to be a “verified” cluster peer, this gives little reassurance in today’s distributed systems. If one node in a cluster is hacked through another method, this weakness lets the attacker quickly “spread” to every other node, changing a local problem into a worldwide failure.
The Wazuh team has put out a fix that adds strict rules for paths and makes them standard. All admins should upgrade their clusters right away.
