CVE-2026-74047: Wazuh Information Disclosure Vulnerability

CVE-2026-74047 Overview

CVE-2026-74047 is an information disclosure vulnerability in Wazuh versions 4.0.0 through 4.14.7. The flaw allows low-privileged users holding the agent:read permission to retrieve the plaintext authd.pass enrollment password through the unmasked agent configuration endpoint. Attackers assigned the default readonly role can query the auth component configuration for pseudo-agent ID 000 and obtain the manager's enrollment secret. With this secret, an attacker can enroll rogue agents against the Wazuh manager and inject arbitrary telemetry into the monitoring pipeline. The vulnerability is tracked as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Low-privileged readonly users can extract the Wazuh enrollment password and register unauthorized agents, undermining the integrity of security monitoring data.

Affected Products

Wazuh server versions 4.0.0 through 4.14.7
Deployments exposing the Wazuh API with the default readonly role assigned to users
Wazuh manager components exposing the auth configuration endpoint for pseudo-agent 000

Discovery Timeline

2026-10-13 - CVE-2026-74047 published to the National Vulnerability Database
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-74047

Vulnerability Analysis

The vulnerability resides in the Wazuh API endpoint that returns the active agent configuration. When a client requests the auth component configuration for pseudo-agent ID 000, the server returns the full configuration without masking the authd.pass field. The field holds the shared enrollment secret used by ossec-authd to authenticate new agents joining the manager.

Authorization for this endpoint only requires the agent:read permission, which is granted by the default readonly role. As a result, any user able to authenticate against the API, including unprivileged auditors or integration accounts, can read the enrollment password in cleartext. Possession of the password enables an adversary to call the enrollment service and register attacker-controlled agents against the manager.

Root Cause

The root cause is insufficient output filtering in the agent configuration endpoint. Sensitive fields such as authd.pass are not redacted before being serialized into the API response. The permission model also underscopes the request. Reading the enrollment password should require an administrative permission rather than the broadly granted agent:read capability.

Attack Vector

An authenticated attacker holding readonly API credentials issues a request to the Wazuh manager asking for the auth component configuration of agent 000. The response includes the plaintext authd.pass value. The attacker then uses that secret to connect to ossec-authd on the manager and enroll one or more rogue agents. Those agents can submit forged events, suppress alerting, or dilute analyst attention. Technical specifics are available in the GitHub Security Advisory GHSA-qj8j-r988-54rx and the VulnCheck Advisory for Wazuh 4.0.0.

Detection Methods for CVE-2026-74047

Indicators of Compromise

Wazuh API access logs showing non-administrative users requesting the agent configuration endpoint for agent ID 000 with the auth component.
Unexpected agent enrollments in ossec-authd logs originating from unfamiliar source IP addresses.
New agents appearing in the Wazuh manager inventory that do not correspond to provisioned assets.
Spikes in agent:read API calls from service accounts or integration users that do not normally query agent configuration.

Detection Strategies

Audit Wazuh API logs for requests matching the pattern GET /agents/000/config/auth/auth and alert on any caller lacking an administrator role.
Correlate successful auth configuration reads with subsequent ossec-authd enrollment events from the same or related source addresses.
Baseline the set of users assigned the default readonly role and alert when they access configuration endpoints beyond read-only agent status.

Monitoring Recommendations

Forward Wazuh API and ossec-authd logs to a centralized log platform for retention and correlation.
Monitor enrollment volume on the manager and alert on bursts that exceed normal provisioning patterns.
Review all accounts assigned the readonly role on a recurring schedule and remove unused or shared credentials.

How to Mitigate CVE-2026-74047

Immediate Actions Required

Upgrade Wazuh manager deployments to version 4.14.8 or later using the official Wazuh Release v4.14.8.
Rotate the authd.pass enrollment password after upgrading to invalidate any previously exposed secret.
Review Wazuh manager inventory and remove any agents that cannot be matched to authorized assets.
Restrict the default readonly role so that only trusted operators retain API access.

Patch Information

Wazuh addressed the issue in version 4.14.8. The fix prevents the agent configuration endpoint from returning the plaintext authd.pass field in responses to users lacking elevated privileges. Detailed release notes are available in the Wazuh v4.14.8 release and the GitHub Security Advisory GHSA-qj8j-r988-54rx.

Workarounds

Until patching is possible, remove the agent:read permission from the default readonly role or disable readonly accounts on the Wazuh API.
Restrict network access to the Wazuh API and ossec-authd enrollment port using firewall rules so only trusted management hosts can connect.
Replace password-based enrollment with certificate-based agent registration where supported, eliminating reliance on the shared authd.pass secret.

bash

# Configuration example: disable password-based enrollment on the manager
# Edit /var/ossec/etc/ossec.conf and set the <use_password> option to no
# <auth>
#   <use_password>no</use_password>
# </auth>
# Then restart the manager
systemctl restart wazuh-manager