CVE-2026-74047
6.5MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-200
Impact
Low-privileged users with agent:read permissions can retrieve the plaintext agent enrollment password and register rogue agents to the manager. An attacker needs valid network access and default readonly credentials to the Wazuh API.
Root cause
The agent configuration API endpoint exposes unmasked auth component configuration details, including authd.pass, when queried for pseudo-agent ID 000.
Affected systems
Wazuh 4.0.0 before 4.14.8
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade Wazuh manager to version 4.14.8 or later. If upgrading immediately is not possible, restrict API users from holding the agent:read permission or revoke readonly access.
$ sudo apt-get update && sudo apt-get install --only-upgrade wazuh-managerAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Attackers holding the default readonly role can request the auth component configuration for pseudo-agent ID 000 to obtain the secret and enroll rogue agents against the manager.