CVE-2026-74032: Wazuh Auth Bypass Vulnerability

CVE-2026-74032 Overview

CVE-2026-74032 is an authorization bypass vulnerability in Wazuh versions 4.0.0 through 4.14.7. The flaw allows low-privileged authenticated users to enumerate the full Role-Based Access Control (RBAC) catalog by querying unprotected security endpoints. Specifically, GET /security/actions and GET /security/resources return the complete list of privileged actions and endpoints without filtering responses against the caller's RBAC policies. Attackers use this information to map privileged operations and plan privilege escalation paths. The issue is tracked under CWE-863: Incorrect Authorization and is resolved in Wazuh 4.14.8.

Critical Impact
Any authenticated Wazuh user, regardless of assigned role, can enumerate the entire RBAC action and resource catalog, exposing privileged endpoints for subsequent privilege escalation attempts.

Affected Products

Wazuh 4.0.0 through 4.14.7
Wazuh server components exposing the /security/actions endpoint
Wazuh server components exposing the /security/resources endpoint

Discovery Timeline

2026-10-13 - CVE-2026-74032 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-74032

Vulnerability Analysis

The vulnerability resides in Wazuh's security API, which exposes administrative metadata through the /security/actions and /security/resources endpoints. These endpoints enumerate every RBAC action and resource identifier defined within the Wazuh server. The handlers authenticate the caller but do not apply the caller's RBAC policies to the response payload. As a result, a user with minimal permissions receives the same catalog an administrator would. The exposed metadata reveals privileged capabilities such as agent management actions, rule modification endpoints, and system configuration operations. Attackers combine this map with other weaknesses to focus privilege escalation attempts on specific high-value endpoints.

Root Cause

The handlers for GET /security/actions and GET /security/resources lack policy enforcement. Standard Wazuh API endpoints filter responses against the caller's effective RBAC policies before returning data. These two endpoints omit that filter and return the full catalog by design. The underlying weakness falls under CWE-863: Incorrect Authorization, where an authorization check is present at the authentication layer but missing or incomplete at the resource layer.

Attack Vector

Exploitation requires network reachability to the Wazuh API and valid credentials for any account, including read-only or restricted roles. The attacker sends an HTTP GET request to /security/actions or /security/resources with a valid bearer token. The server returns the complete action and resource inventory. The attacker parses the response to identify endpoints associated with privileged operations and uses that knowledge to craft targeted follow-on requests. No special tooling, user interaction, or elevated privileges are required beyond the initial low-privileged login.

For technical details, see the Wazuh GitHub Security Advisory GHSA-vh8p-3xvw-w536 and the VulnCheck Advisory on the RBAC bypass.

Detection Methods for CVE-2026-74032

Indicators of Compromise

HTTP GET requests to /security/actions or /security/resources originating from accounts without administrative roles.
Repeated enumeration patterns against the Wazuh security API from a single authenticated session.
Follow-on requests targeting privileged endpoints discovered through the exposed catalog.

Detection Strategies

Review Wazuh API access logs for calls to /security/actions and /security/resources by non-administrator users.
Alert on authenticated users enumerating multiple /security/* endpoints within a short time window.
Correlate catalog enumeration events with subsequent requests to privileged endpoints such as agent, rule, or configuration APIs.

Monitoring Recommendations

Forward Wazuh API logs to a centralized logging platform and retain them for post-incident analysis.
Baseline normal API usage per account role, then alert on deviations such as low-privileged accounts touching administrative paths.
Monitor for new or unexpected API tokens issued to service accounts that could be abused to query the security endpoints.

How to Mitigate CVE-2026-74032

Immediate Actions Required

Upgrade all Wazuh deployments to version 4.14.8 or later.
Audit existing Wazuh user accounts and remove unused or over-provisioned credentials.
Review Wazuh API access logs for prior enumeration of /security/actions and /security/resources.
Rotate API tokens for accounts that may have been used to query the exposed endpoints.

Patch Information

Wazuh released the fix in version 4.14.8. See the Wazuh v4.14.8 release notes on GitHub for the complete changelog. The patched handlers now apply the caller's RBAC policies to the response payload before returning the catalog, ensuring that users see only the actions and resources they are authorized to access.

Workarounds

Restrict network access to the Wazuh API so that only trusted administrative hosts can reach the /security/* endpoints.
Place the Wazuh API behind a reverse proxy that denies requests to /security/actions and /security/resources from non-administrator identities.
Minimize the number of accounts with any level of Wazuh API access until the upgrade is completed.

bash

# Example reverse proxy rule to block low-privileged access to the affected endpoints
# Adjust the allow list to match your administrative source addresses
location ~ ^/security/(actions|resources)$ {
    allow 10.0.0.0/24;   # admin subnet
    deny all;
    proxy_pass https://wazuh-api-backend;
}