PT-2026-61613 · Wazuh · Wazuh

CVE-2026-28220 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wazuh versions prior to 4.14.5

Description Issues in the Cluster Distributed API (DAPI) handling allow a cluster peer or any actor authenticated to the cluster channel using the shared cluster key to force the master node to deserialize and execute an attacker-controlled callable under an attacker-controlled RBAC context. The vulnerability exists because the as wazuh object() function in framework/wazuh/core/cluster/common.py deserializes JSON using an overly broad allowlist defined by ALLOWED CALLABLES PACKAGES. Additionally, DAPI requests in framework/wazuh/core/cluster/dapi/dapi.py accept a client-supplied rbac permissions value that the run local() function applies as the global RBAC context. By supplying an rbac mode of black, authorization checks for functions protected by expose resources are bypassed. This combination enables privileged administrative actions on the master node, including arbitrary file writes under WAZUH PATH, creation of new API users, and tampering with security.yaml, which can lead to full manager compromise.

Recommendations Update to version 4.14.5.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-28220

GHSA-W2JJ-PFQ9-MH9P

Affected Products

Wazuh

References · 6

• 🔥 https://github.com/wazuh/wazuh/security/advisories/GHSA-w2jj-pfq9-mh9p · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28220.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-28220 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28220 · Security Note
• https://twitter.com/UpwindMDR/status/2079251948453109779 · Twitter Post
• https://twitter.com/CVEnew/status/2079238917065175309 · Twitter Post