CVE-2026-30893 is a critical path traversal flaw (CVSS 9.0) in Wazuh cluster synchronization, affecting versions 4.4.0 up to before 4.14.4. An authenticated cluster peer can write files on other nodes. Upgrade every node to Wazuh 4.14.4.
What's affected
Wazuh from version 4.4.0 to before version 4.14.4 is affected. The patched version is 4.14.4.
The risk is to clustered deployments, where nodes extract synchronization data sent by peers.
How to check if you're exposed
On each manager node, print the version:
/var/ossec/bin/wazuh-control info
Compare the result with 4.14.4 for every node in the cluster, since one unpatched node is enough to be a target. Then list which hosts are allowed to join the cluster and confirm each one is yours.
What to do now
- Upgrade every Wazuh cluster node to 4.14.4 or later.
- Restrict network access to the cluster port so only known nodes can connect, and protect the cluster key.
- Check which user the cluster daemon runs as. The record says system level compromise is possible where it runs with elevated privileges.
- Review the file system on cluster nodes for unexpected changes to Python modules used by Wazuh.
Why it matters
The weakness classes are CWE-22, path traversal, and CWE-73, external control of file name or path. The routine that extracts synchronization archives did not stop paths from escaping the intended directory, so a peer could write outside it.
The record says this can be escalated to code execution by overwriting Python modules that Wazuh components load. A security monitoring platform is a high value target, because it holds logs and often has wide reach. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does an attacker need to be logged in?
The record says an authenticated cluster peer, so the attacker needs to act as a cluster node. That raises the bar but does not remove the need to patch.
Is a single node install affected?
The record describes cluster synchronization. Single node installs do not use it the same way, but upgrading is still sensible.
Sources
Last reviewed: 19 October 2026.
