CVE-2026-46343 is a high severity (CVSS 7.2) path traversal in Wazuh. A cluster-authenticated node can delete files outside the Wazuh install path, including config, JWT secret and certificates. Upgrade the manager to 4.14.6 and limit which nodes can join your cluster.
What's affected
- Wazuh manager: from 4.0.0 up to the fix. The advisory lists 4.14.6 as the patched version.
The record also lists 5.0.0-beta2 as a fixed version, while the GitHub advisory page I read names only 4.14.6 as patched. If you run a 5.0 beta, check the project release notes rather than assuming.
The attacker needs to be a cluster-authenticated node, so exposure is mainly to multi-node deployments.
Severity sources differ. The record scores it 7.2 (High). The advisory scores it 7.5 (CVSS 4.0, High).
How to check if you're exposed
On each manager node, print the installed version:
/var/ossec/bin/wazuh-control info
Then confirm whether the node runs in cluster mode by reading the cluster section of ossec.conf. Single-node deployments with clustering disabled have less exposure to a rogue cluster member, though upgrading is still the right move.
What to do now
- Upgrade Wazuh managers to 4.14.6 or later. The advisory lists no workaround.
- Limit which hosts can reach the cluster port and make sure only nodes you control hold the cluster key. This is general hardening, not an advisory step.
- Back up
ossec.conf,jwt_secret.json, certificates and ruleset files so a deletion does not become an outage. - Watch for unexpected manager restarts or API token failures, which are symptoms the record describes.
Why it matters
The cause is CWE-22, path traversal. In the cluster file transfer code, a request with an unknown task identifier reaches a cleanup branch, and an attacker-controlled file name is joined to a base path without being resolved or confined. Absolute paths and traversal sequences can therefore point at files that the manager process can reach.
Deleting a configuration file, the JWT secret or TLS certificates can stop the manager, invalidate API tokens or break cluster and API connectivity. A security monitoring platform that goes dark is a bad place to lose visibility. The record does not mark this CVE as known exploited.
If you run a Wazuh cluster, treat the cluster key and node enrollment as security controls in their own right. A node you no longer trust should be removed and the key rotated, which limits what a compromised member can do.
Quick check
Does an outside attacker with no credentials reach this flaw?
No. A cluster-authenticated node is required. The risk is a compromised or rogue node inside the cluster.
What can be deleted?
Files the manager process can reach, such as ossec.conf, jwt_secret.json, TLS certificates and ruleset files, according to the record.
Sources
Last reviewed: 18 October 2026.
