CVE-2026-74032

4.3Medium

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-863

Impact

Authenticated low-privileged users can read the complete RBAC catalog and map privileged actions and endpoints to plan further attacks. Attackers require network access and valid credentials to the Wazuh API.

Root cause

The /security/actions and /security/resources endpoints fail to enforce the caller's RBAC policies before returning security metadata.

Affected systems

Wazuh 4.0.0 before 4.14.8

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade Wazuh manager and API to version 4.14.8 or later. If upgrading immediately is not possible, restrict or block network access to the Wazuh API endpoints /security/actions and /security/resources using a reverse proxy or API gateway.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade wazuh-manager

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read the RBAC catalog by querying unprotected security endpoints. Attackers can request GET /security/actions and /security/resources, which omit the caller's RBAC policies, to map privileged actions and endpoints for privilege escalation planning.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-74032