CVE-2026-74034
Received Received - Intake

Wazuh Agent File Path Traversal Vulnerability

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root, exfiltrating /etc/shadow and client.keys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-74034
EUVD
EUVD-2026-98672

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wazuh wazuh-manager 4.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74034 is a missing origin check vulnerability in Wazuh versions 4.1.0 to 4.14.7. It allows enrolled agents to send an upgrade_custom command with a malicious file_path parameter. The manager's wazuh-modulesd processes these commands without verifying the source, enabling agents to read arbitrary files as root, including sensitive files like /etc/shadow and client.keys.

Detection Guidance

Check Wazuh manager version with 'wazuh-control -V' or 'rpm -qa | grep wazuh-manager'. If version is between 4.1.0 and 4.14.7, the system is vulnerable. Inspect agent communications for unexpected upgrade_custom commands via network monitoring tools.

Impact Analysis

This vulnerability allows attackers to read sensitive files on the Wazuh manager host as root. This includes critical system files like /etc/shadow and configuration files containing TLS keys or agent pre-shared keys. Attackers can exfiltrate this data, potentially leading to further compromise of the system or impersonation of agents.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA. Exposure of personal or health information due to arbitrary file reads may result in data breaches, legal penalties, and reputational damage for organizations handling regulated data.

Mitigation Strategies

Upgrade Wazuh manager to version 4.14.8 or later immediately. Disable passwordless agent enrollment if enabled. Restrict network access to agent-facing ports. Review file permissions on sensitive files like /etc/shadow and client.keys.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74034. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart