CVE-2026-74033
HIGH
MEDIUM
Priority: 0.03
BB Relevance:
47/100
Published: 2026-10-13
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Adjacent
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Adjacent
AC:
Low
PR:
High
UI:
None
AT:
None
VC:
High
VI:
High
VA:
None
Description
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path, bypassing REST validation and RBAC to delete files like rbac.db.