CVE-2026-74047
Received Received - Intake

Information Disclosure in Wazuh Agent Configuration

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Attackers holding the default readonly role can request the auth component configuration for pseudo-agent ID 000 to obtain the secret and enroll rogue agents against the manager.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-74047
EUVD
EUVD-2026-98680

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wazuh wazuh-manager 4.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74047 is an information disclosure vulnerability in Wazuh versions 4.0.0 to 4.14.7. It allows low-privileged users with agent:read permission to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Attackers with the default readonly role can request the auth component configuration for pseudo-agent ID 000 to obtain this secret and enroll unauthorized agents against the manager.

Detection Guidance

Check Wazuh manager versions 4.0.0 to 4.14.7 for unauthorized requests to GET /agents/000/config/authd/authd.pass. Monitor logs for low-privileged users accessing agent configuration endpoints.

Impact Analysis

An attacker exploiting this vulnerability can obtain the authd.pass password, register rogue agents, and gain unauthorized network access. This could lead to system compromise, data breaches, or further lateral movement within the network. The impact includes potential loss of confidentiality and unauthorized system access.

Compliance Impact

This vulnerability could lead to unauthorized access and data exposure, violating compliance requirements for data protection such as GDPR (data confidentiality) and HIPAA (protected health information security). Organizations may face penalties or legal consequences due to non-compliance resulting from this breach.

Mitigation Strategies

Upgrade Wazuh manager to version 4.14.8 or later. Ensure no unauthorized agent enrollments occurred using the exposed authd.pass. Review user permissions to restrict agent:read access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74047. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart