Critical RCE in Wazuh DAPI Protocol (CVE‑2026‑44901) Enables Remote Code Execution on Cluster Master
What It Is — A deserialization flaw in the sort_casting field of Wazuh’s DAPI protocol allows an attacker who can run low‑privileged code on a worker node to execute arbitrary commands as root on the master node.
Exploitability — CVSS 9.9 (Critical). Network‑adjacent attacker, low‑complexity, no user interaction required. No public exploit code released, but the vulnerability is fully disclosed and a patch is available.
Affected Products — Wazuh (all versions prior to the August 2026 security update).
Why It Matters for Compliance & Audit Readiness
- Control‑mapping gaps: The flaw bypasses expected segregation of duties between worker and master nodes, a key SOC 2 CC6.1 (Logical Access) control.
- Continuous evidence: Demonstrating that you have an up‑to‑date patch management process and automated validation of configuration drift is essential audit evidence.
- Trust for customers: Enterprise buyers increasingly require proof that security tooling itself is hardened; a vulnerable SIEM can invalidate your own monitoring controls.
Recommended Actions
- Apply the Wazuh security update (GHSA‑8c6v‑7g3w‑prrq) immediately across all clusters.
- Verify that the
sort_castingfield is no longer accepted for untrusted input by running the vendor‑provided test script. - Update your SOC 2 control inventory to map “Secure Configuration Management” (CC6.2) to the patch‑management process and capture the patch‑install logs as continuous compliance evidence.
- Enable automated configuration drift detection on the master node and integrate findings into your audit‑ready dashboard.