CVE-2026-44901: Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
Vulnerability summary
CVE-2026-44901 is a high (CVSS 8.4) Deserialization of Untrusted Data vulnerability in wazuh. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 54.2% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 19-08-2026PublishedVulnerability first disclosed.
- 19-08-2026Last modifiedVulnerability information updated.
Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge() in framework/wazuh/core/results.py trusts the sort_casting field in a cluster worker's JSON response. During a distributed API merge, attacker-controlled type names are resolved through Python builtins without an allowlist. A compromised worker can set sort_casting to exec and place Python source in affected_items, causing the master to execute the payload as root when responses from multiple nodes are merged. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST8.4HighCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.74%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
Increase +0.07 pp
From 0.67% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundWazuh
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Wazuh1 product
- wazuh≥ 5.0.0-beta1, < 5.0.0-beta2 | ≥ 4.0.0, < 4.14.6 | 5.0.0:beta1 | 5.0.0:beta2
1 vendor · 1 product
References
5 links- github.com/wazuh/wazuh/security/advisories/GHSA-8c6v-7g3w-prrqX Refsource CONFIRMExploitVendor Advisory