Security readout for executives and security teams
Plain-English summary
A malicious or compromised Wazuh cluster node can trick the master into returning readable files. If it obtains the API signing key, it can create administrator tokens and control Wazuh through its REST API. The evidence does not describe exploitation by unauthenticated outsiders; the attacker must be a cluster peer holding the shared Fernet key.
Executive priority
Prioritize immediate remediation for affected Wazuh clusters, especially where peer integrity or key custody is uncertain. Because Wazuh is a security-management platform, forged administrator access could undermine monitoring and response operations. Upgrade promptly and initiate incident investigation if any cluster peer or shared key may have been compromised.
Technical view
DistributedAPI.send_tmp_file joins a peer-controlled tmp_file value to WAZUH_PATH without canonicalization or confinement. Traversal or absolute paths can disclose readable master files over the cluster channel. Disclosure of private_key.pem enables offline administrator-token forgery. Cluster-peer access and possession of the shared Fernet key are prerequisites.
Likely exposure
Exposure applies to clustered Wazuh managers running 4.0.0 through 4.14.5, or 5.0.0-beta1 through beta2. Risk is highest where a cluster peer or shared Fernet key could be compromised. The supplied evidence does not establish that standalone deployments or internet exposure alone are sufficient.
Exploitation context
The CVE is not listed as KEV, and the supplied sources do not report active exploitation. Exploitation is low complexity after obtaining the high-privilege prerequisite: control of a cluster peer holding the shared Fernet key. Successful abuse can cross the cluster-to-API trust boundary and provide administrator privileges.
Researcher notes
This is CWE-73: external control of a file name or path. CVSS 3.1 is 9.1, with network reachability, low complexity, high privileges required, changed scope, and high confidentiality, integrity, and availability impacts. The supplied bundle provides patch and release references but no public proof-of-concept or observed exploitation evidence.
Mitigation direction
- Upgrade affected 4.x managers to Wazuh 4.14.6 or a later fixed release.
- Upgrade affected 5.0 beta managers to Wazuh 5.0.0-beta3 or a later fixed release.
- Restrict cluster membership and protect the shared Fernet key from unauthorized access.
- If compromise is suspected, treat cluster and API signing keys as exposed and follow Wazuh guidance for safe rotation.
Validation and detection
- Inventory Wazuh manager versions and flag 4.0.0–4.14.5 or 5.0.0-beta1–beta2.
- Verify every joined cluster peer is authorized and the shared Fernet key has not been exposed.
- Confirm all cluster managers run a fixed release before considering remediation complete.
- Where telemetry exists, investigate unexpected master-file transfers and unexplained administrator REST API activity.
- Treat private_key.pem as potentially disclosed if suspicious peer activity is identified.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-73: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-48162 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H2.36GitHub_MVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/wazuh/wazuh/security/advisories/GHSA-r6f5-h662-8ffcCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/wazuh/wazuh/pull/36246CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/wazuh/wazuh/commit/de1eeedbe336744934be4e20d87d84a76e438ceeCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/wazuh/wazuh/releases/tag/v4.14.6CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta3CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
External Control of File Name or Path
External Control of File Name or Path represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.