CVE-2026-44901 Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
A compromised cluster worker can trigger remote code execution as root on the Wazuh master node via unsafe deserialization in the DAPI protocol.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-44901?
CVE-2026-44901 is a high-severity unsafe deserialization vulnerability in Wazuh Wazuh, published on 19 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge() in framework/wazuh/core/results.py trusts the sort_casting field in a cluster worker's JSON response. During a distributed API merge, attacker-controlled type names are resolved through Python builtins without an allowlist. A compromised worker can set sort_casting to exec and place Python source in affected_items, causing the master to execute the payload as root when responses from multiple nodes are merged. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
Weakness: CWE-502
Which versions are affected by CVE-2026-44901?
It affects 1 product.
Products include Wazuh Wazuh.
How do I fix CVE-2026-44901?
No fix has been published for CVE-2026-44901 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-44901 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44901 exists.
Other vulnerabilities in Wazuh Wazuh
- CVE-2025-24016 Wazuh Server Deserialization of Untrusted Data
- CVE-2024-32038 Wazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2021-44079 Command injection in n/a
- CVE-2024-1243 Remote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theft
- CVE-2026-61800 Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)
Sources
Also known as GHSA-8c6v-7g3w-prrq.