CVE-2026-74033

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the getlists and deletelistfile CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path,...