CVE-2026-46343

CVE-2026-46343 is a path traversal vulnerability in Wazuh's cluster communication layer that allows an authenticated cluster node to delete arbitrary files on the manager. The vulnerability lives in the `end_receiving_file()` function, which handles task completion for inter-node file transfers. When processing a `syn_i_w_m_e` (sync information with master enrollment) request, the function accepts a `task_id` parameter that controls which file gets deleted from the manager's filesystem. An attacker controlling a cluster node — whether compromised credentials, a malicious node, or simply an自动化 script — can embed path traversal sequences in the task_id (`../../../etc/jwt_secret.json`) that survive the `os.path.join()` operation and reach `os.unlink()`, resulting in arbitrary file deletion with manager privileges. What makes this CVE significant is not the technical complexity — it's the architectural failure it exposes. The developers used `os.path.join` as if it were a path containment primitive. It is not. It performs string concatenation. The function assumes that anything arriving via cluster authentication is trusted input, and that assumption creates a false security boundary. Cluster authentication is a coordination mechanism, not a security boundary — a node can be compromised, credentials can be stolen, and the protocol can be abused by any peer that passes the auth check. The fix (path canonicalization via `os.path.normpath` or `os.path.realpath` followed by confinement checking) is straightforward and was likely available in the CVEs from which this pattern should have been learned. The blast radius extends far beyond the cluster node. Deleting `jwt_secret.json` invalidates every active API token, automation script session, and SIEM integration. Following that with `ossec.conf` deletion removes the ruleset governing threat detection across hundreds of agents. The security management plane becomes blind. CVSS 7.5 does not capture this cascade — it measures the vulnerability in isolation, not the catastrophic outcome of successful exploitation. Beyond patching `end_receiving_file()`, conduct a full audit of the cluster communication stack for other `os.path.join` calls operating on untrusted input. Prioritize error handling paths specifically — input validation discipline predictably collapses in cleanup and failure branches, and that's where this class of bug recurs. The question is not whether this vulnerability exists but whether the architectural pattern of trusting cluster-authenticated input persists in other paths that haven't been reviewed.

Reviewed through automated stages and approved by a human before publication.