CVE-2026-44252

CVE-2026-44252 is a trust architecture failure, not merely an information disclosure. The vulnerability transforms a single leaked Fernet encryption key into complete cluster compromise because the Wazuh master node accepts authorization context from workers without re-validating it. When an attacker obtains the Fernet key—through the read-only API user or any other means—they gain the ability to forge legitimate-looking worker communications with attacker-controlled rbac_permissions and rbac_mode set to 'black', bypassing all role-based access controls. The CVSS 7.7 score drastically understates the severity. The initial access requires only a low-privilege read-only API user, but that foothold cascades into arbitrary user creation, administrative role assignment, credential exfiltration, configuration modification, and cross-agent execution across every monitored endpoint. Wazuh agents run across production systems, cloud workloads, and network infrastructure—compromising the manager doesn't just breach one system, it hands the attacker administrative control over the entire monitored infrastructure through native remediation capabilities. The critical mechanism is the 'black' rbac_mode, a legacy debugging bypass that should have been removed rather than left embedded in the codebase. The Fernet key's dual role—functioning as both an encryption key and an implicit authorization token—is the architectural flaw that makes this exploitation possible. Encryption material should never imply authorization authority, yet that's exactly what occurred here through organic system growth rather than deliberate design. Your priorities: First, verify whether 4.14.5 re-validates worker-supplied RBAC context on the master or merely closes the read-only API disclosure vector—if only the latter, the 'black' mode remains exploitable via future key exposure. Second, audit for other code paths that might expose the cluster key. Third, treat this as a class of vulnerability: audit your own systems for artifacts whose roles have drifted from encryption-only to encryption-plus-authorization. This pattern—encryption material silently accumulating implicit trust—has recurred across JWT, deserialization frameworks, and SSH host keys. The structural condition that enabled it (no clear ownership of inter-node trust assumptions) likely persists in other distributed systems you operate.

Reviewed through automated stages and approved by a human before publication.