CVE-2026-74037: Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token
Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for runas users with zero static roles, because checktoken never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Wazuh versions from 4.0.0 before 4.14.8 are affected. The issue applies to run_as users that have zero static roles and have been issued tokens.
What access does an attacker need to exploit this?
An attacker needs a previously issued token associated with a run_as user whose administrator grants were revoked. They can continue authenticating because the token blacklist is not consulted, then self-link the administrator role to retain privileged access.
Does revoking an administrator grant remove the risk?
No. For the affected run_as-user condition, revocation does not invalidate already issued tokens, allowing continued authentication and potential restoration of administrator access.
How can I determine whether I may be affected?
Identify Wazuh installations running a version earlier than 4.14.8, then review whether run_as users with zero static roles were issued tokens before their administrator grants were revoked.