CVE-2026-28220

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API DAPI handling allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to make the maste...

CVE-2026-28220

Wazuh prior to version 4.14.5 is affected by a CVE in the Cluster Distributed API (DAPI) handling. The issue stems from the cluster code in framework/wazuh/core/cluster/common.py deserializing JSON via as_wazuh_object(), which can resolve any callable whose top-level package is wazuh or api due t...