CVE-2026-74037 Overview
CVE-2026-74037 is a session invalidation bypass in Wazuh, an open-source security monitoring platform. Versions 4.0.0 through 4.14.7 fail to invalidate issued JSON Web Tokens (JWTs) for run_as users that have zero static roles. The check_token function never consults the token blacklist for these users. Attackers who previously held administrator grants and had those grants revoked can continue authenticating with their old tokens. Once authenticated, they can self-link the administrator role back to their account to permanently restore privileged access. The flaw maps to [CWE-613: Insufficient Session Expiration].
Critical Impact
Revoked administrator accounts retain full authenticated access to Wazuh and can re-grant themselves the administrator role, defeating credential revocation as a containment control.
Affected Products
- Wazuh versions 4.0.0 through 4.14.7
- Wazuh server component implementing check_token session validation
- Deployments using run_as authentication for users with zero static roles
Discovery Timeline
- 2026-10-13 - CVE-2026-74037 published to the National Vulnerability Database
- 2026-10-15 - Last updated in the NVD database
- Wazuh 4.14.8 - Fixed release published on GitHub
Technical Details for CVE-2026-74037
Vulnerability Analysis
Wazuh issues JWT bearer tokens to authenticated API users. When administrators revoke a user's privileges, the backing token identifier is placed on a server-side blacklist. The check_token routine is supposed to reject any presented token that appears on this blacklist before processing the request. For users authenticated through the run_as mechanism who hold no static roles, check_token skips the blacklist lookup entirely. The token continues to validate cryptographically and is accepted as a live session.
Once the attacker's session is treated as valid, the API permits the account to invoke role-linking endpoints. The attacker links the administrator role directly to their own user identity, re-establishing privileged access that survives further revocation attempts and token rotations.
Root Cause
The root cause is a missing authorization check in the token validation path. The check_token function branches on whether the authenticated principal has static roles assigned. For run_as principals with zero static roles, the branch bypasses the revocation blacklist consultation. This is a classic Insufficient Session Expiration defect because the server trusts the JWT's cryptographic signature as sole proof of session validity rather than enforcing the revocation state.
Attack Vector
Exploitation requires an attacker who previously held high-privilege API credentials and whose grants have since been revoked. The attacker reuses a previously issued JWT against the Wazuh API over the network. No user interaction is required and attack complexity is low. After the API accepts the stale token, the attacker calls the role-user link endpoint to attach administrator to their own account. All subsequent requests then operate with full administrator privileges, including the ability to modify agent policies, exfiltrate telemetry, and disable detection rules.
No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-3xm6-wp5v-2fm9 and the VulnCheck Wazuh Session Bypass Advisory for the vendor's technical description.
Detection Methods for CVE-2026-74037
Indicators of Compromise
- API authentication events from user accounts whose privileges were previously revoked, especially from run_as principals.
- Successful calls to role-user link endpoints that assign the administrator role to non-administrator accounts.
- JWT identifiers appearing in authenticated requests after the corresponding token identifier has been added to the Wazuh revocation blacklist.
- Unexpected changes to Wazuh RBAC policies, agent groups, or active response configuration shortly after a credential revocation event.
Detection Strategies
- Correlate Wazuh API access logs with the server's token revocation events to flag any accepted request bearing a blacklisted jti.
- Alert on administrative actions performed by any user other than designated administrator accounts, particularly role assignment operations.
- Baseline normal run_as authentication patterns and alert on activity from run_as users carrying zero static roles.
Monitoring Recommendations
- Forward Wazuh manager API audit logs to a centralized logging platform and retain them for post-incident review.
- Monitor the /security/roles/{role_id}/users endpoint for unexpected administrator role linkages.
- Track all 200-series responses to privileged endpoints that originate from recently revoked user identifiers.
How to Mitigate CVE-2026-74037
Immediate Actions Required
- Upgrade Wazuh to version 4.14.8 or later, which contains the fix for check_token blacklist enforcement.
- Audit the current list of users assigned the administrator role and remove any unauthorized linkages.
- Rotate the JWT signing key on the Wazuh manager to invalidate all previously issued tokens system-wide.
- Review RBAC policy changes and run_as authentication activity since the environment was first deployed on an affected version.
Patch Information
The fix is included in Wazuh Release v4.14.8. The patched check_token implementation consults the revocation blacklist for all authenticated principals, including run_as users with zero static roles. Operators running any 4.0.0 through 4.14.7 release should plan an upgrade.
Workarounds
- Avoid issuing run_as tokens to users that have zero static roles until the upgrade is applied.
- Enforce short JWT lifetimes on the Wazuh manager to limit the window during which a revoked token remains cryptographically valid.
- Restrict network access to the Wazuh API to trusted management subnets so that stolen tokens cannot be reused from arbitrary network locations.
- Rotate the JWT signing secret periodically as a compensating control until patching is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.