CVE-2026-74035: Wazuh Authentication Bypass Vulnerability

CVE-2026-74035 Overview

CVE-2026-74035 is an authentication bypass vulnerability in Wazuh, the open-source security monitoring platform. The flaw affects Wazuh versions from 4.6.0 before 4.14.8 in the security.update_user function. A delegated user administrator can send an empty password to the user update endpoint, bypassing the reserved user guard and password policy enforcement. The result is complete takeover of the wazuh superuser account, after which an attacker can authenticate with empty credentials. The vulnerability is tracked under CWE-863: Incorrect Authorization.

Critical Impact
An authenticated low-privilege user administrator can hijack the Wazuh superuser account and subsequently authenticate without a password, gaining full administrative control over the Wazuh deployment.

Affected Products

Wazuh 4.6.0 through 4.14.7
Wazuh Manager API component (security.update_user endpoint)
Fixed in Wazuh 4.14.8

Discovery Timeline

2026-10-13 - CVE-2026-74035 published to NVD
2026-10-13 - Last updated in NVD database
Patch Release - Wazuh 4.14.8 published on GitHub addressing the issue

Technical Details for CVE-2026-74035

Vulnerability Analysis

The vulnerability resides in the security.update_user function within the Wazuh API. This function is responsible for updating user attributes, including passwords, and enforces two protections: a reserved user guard that prevents modification of built-in accounts such as the wazuh superuser, and a password policy check that validates password strength and format.

Both protections are nested inside a falsy truthiness check that evaluates the submitted password. When the password field is empty, the check short-circuits and skips both the reserved user guard and the password policy enforcement. A delegated user administrator with permission to update user accounts can therefore submit an empty password targeting the wazuh superuser account. The update succeeds, the reserved user protection is never evaluated, and the superuser password is set to an empty value.

After the update, an attacker can authenticate to the Wazuh API as the superuser with no password. This yields full administrative control, including the ability to manage agents, modify detection rules, and access collected security telemetry.

Root Cause

The root cause is a logic flaw [CWE-863] where authorization controls are placed inside a conditional block that only executes when a password value is truthy. Empty strings bypass the guard entirely, allowing privileged operations to proceed without the intended checks.

Attack Vector

Exploitation requires network access to the Wazuh API and valid credentials for an account with user administration privileges. The attacker issues a PUT request to the user update endpoint targeting the superuser account with an empty password payload. No user interaction is required. Technical details are documented in the GitHub Security Advisory GHSA-27gv-q7q6-f5qh and the VulnCheck Advisory on Wazuh Authentication Bypass.

Detection Methods for CVE-2026-74035

Indicators of Compromise

Successful API authentication events for the wazuh superuser account from unexpected source addresses or at unusual times.
API audit log entries showing PUT requests to the user update endpoint targeting reserved accounts with empty or missing password fields.
Unexpected modifications to agent configurations, detection rules, or security policies performed by the superuser account.

Detection Strategies

Review Wazuh API access logs for update_user operations issued against built-in accounts, especially those originating from delegated administrator sessions.
Alert on any successful authentication to the Wazuh API where the submitted password is empty or where the superuser account is used outside documented workflows.
Correlate user management API calls with subsequent authentication events to identify password resets followed immediately by logins from different sources.

Monitoring Recommendations

Enable verbose API audit logging on all Wazuh Manager nodes and forward logs to a centralized analytics platform.
Baseline normal superuser activity and alert on deviations in frequency, source IP, or operation type.
Monitor for creation of new administrative users or role assignments shortly after any update_user API call.

How to Mitigate CVE-2026-74035

Immediate Actions Required

Upgrade Wazuh Manager instances to version 4.14.8 or later without delay.
Rotate the password for the wazuh superuser account and any other reserved accounts after upgrading.
Audit all delegated user administrator accounts and revoke any that are no longer required.
Review API audit logs for signs of prior exploitation, focusing on update_user calls targeting reserved accounts.

Patch Information

Wazuh addressed the vulnerability in release 4.14.8. Details are available in the GitHub Release v4.14.8 notes and the vendor's GitHub Security Advisory GHSA-27gv-q7q6-f5qh. The fix relocates the reserved user guard and password policy enforcement outside the truthiness check so that both protections apply regardless of the submitted password value.

Workarounds

Restrict network access to the Wazuh API using firewall rules so that only trusted management hosts can reach the user update endpoint.
Minimize the number of accounts granted user administration privileges until the patch can be applied.
Place the Wazuh API behind a reverse proxy that rejects requests to the user update endpoint containing empty password fields.

bash

# Upgrade Wazuh Manager to the patched release
# Debian / Ubuntu
sudo apt-get update
sudo apt-get install wazuh-manager=4.14.8-1

# RHEL / CentOS
sudo yum install wazuh-manager-4.14.8-1

# Verify installed version
/var/ossec/bin/wazuh-control info | grep WAZUH_VERSION