CVE-2026-74034: Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command
Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wmagentupgrade that allows enrolled agents to issue upgradecustom commands with attacker-controlled filepath. Attackers can inject an upgradecustom message over the agent channel to read arbitrary files as root, exfiltrating /etc/shadow and client.keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 4.14.8
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Wazuh deployments running versions from 4.1.0 before 4.14.8 are affected. Exposure applies where an attacker can send crafted messages over the enrolled-agent channel.
What access does an attacker need to exploit it?
The attacker does not need prior privileges or user interaction. They need the ability to inject an upgrade_custom message over the agent channel as an enrolled agent.
What could an attacker obtain?
The flaw permits arbitrary file reads with root-level access in the affected component. Examples identified include /etc/shadow and Wazuh client.keys, which could expose local credential hashes and agent authentication material.
How can this be remediated?
Upgrade Wazuh to version 4.14.8. The affected range is 4.1.0 through versions before 4.14.8.