CVE-2026-74035: Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user
Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.updateuser places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the reserved user guard to take over the wazuh superuser account and authenticate with empty credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 4.14.8
Event History
Frequently Asked Questions
Which Wazuh deployments should be prioritized for remediation?
Deployments running Wazuh versions from 4.6.0 up to, but not including, 4.14.8 are affected. Version 4.14.8 is identified as the fixed release.
What level of access does an attacker need?
An attacker needs delegated user-administrator privileges and access to the user update endpoint. No user interaction is required.
What is the impact if exploitation succeeds?
The attacker can take over the reserved wazuh superuser account and then authenticate using empty credentials. This can result in high impact to confidentiality, integrity, and availability.