CVE-2026-74047: Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint
Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Attackers holding the default readonly role can request the auth component configuration for pseudo-agent ID 000 to obtain the secret and enroll rogue agents against the manager.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 4.14.8
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the agent:read permission can exploit it. This includes users assigned the default readonly role.
What access and request are required to obtain the secret?
The attacker must authenticate with an account that has agent:read, then request the auth component configuration for pseudo-agent ID 000 through the unmasked agent configuration endpoint. No user interaction is required.
What can an attacker do with the disclosed password?
The plaintext authd.pass enrollment password can be used to enroll rogue agents against the Wazuh manager.
Which versions are affected?
Wazuh versions from 4.0.0 before 4.14.8 are affected. Version 4.14.8 is identified as the fixed release.