CVE-2026-74047— Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint
Quick assessment
Affected
Wazuh wazuh-manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Wazuh 在 4.0.0 到 4.14.8 版本之间存在信息泄露漏洞，允许具有 agent:read 权限的低特权用户通过未屏蔽的 agent 配置端点获取明文形式的 authd.pass 注册密码。拥有默认只读角色的攻击者可以请求 pseudo-agent ID 000 的 auth 组件配置，从而获取该秘密，并利用它向管理器注册恶意代理。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local SystemAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Wazuh | wazuh-manager | 4.0.0< 4.14.8 |
affected |
4.14.8 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-74047
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Attackers holding the default readonly role can request the auth component configuration for pseudo-agent ID 000 to obtain the secret and enroll rogue agents against the manager.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Wazuh | wazuh-manager | 4.0.0 ~ 4.14.8 | - |
|
II. Public POCs for CVE-2026-74047
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-74047
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-74047 (2)
Vendor Pages for CVE-2026-74047 (1)
Same Patch Batch · Wazuh · 2026-10-13 · 15 CVEs total
| CVE-2026-74041 | 9.1 CRITICAL | Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch |
| CVE-2026-74040 | 9.1 CRITICAL | Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker |
| CVE-2026-74043 | 9.0 CRITICAL | Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions |
| CVE-2026-74034 | 7.5 HIGH | Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command |
| CVE-2026-74036 | 7.2 HIGH | Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies |
| CVE-2026-74037 | 7.2 HIGH | Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token |
| CVE-2026-74035 | 7.2 HIGH | Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user |
| CVE-2026-74045 | 7.1 HIGH | Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder |
| CVE-2026-74031 | 6.5 MEDIUM | Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers |
| CVE-2026-74033 | 6.1 MEDIUM | Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers |
| CVE-2026-93346 | 5.3 MEDIUM | Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition |
| CVE-2026-74030 | 4.9 MEDIUM | Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion |
| CVE-2026-93347 | 4.9 MEDIUM | Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file |
| CVE-2026-74032 | 4.3 MEDIUM | Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions |
IV. Related Vulnerabilities
Same product: wazuh-manager
-
CVE-2026-93346
Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass -
CVE-2026-93347
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_lis -
CVE-2026-74045
Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-ana -
CVE-2026-74043
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload -
CVE-2026-74041
Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass
Same vendor: Wazuh
-
CVE-2026-93346
Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass -
CVE-2026-93347
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_lis -
CVE-2026-74045
Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-ana -
CVE-2026-74043
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload -
CVE-2026-74040
Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via p
Same weakness: CWE-200
-
CVE-2026-110855
GitPython before 3.2.0 Environment Variable Disclosure via . -
CVE-2026-110696
itsmeravitejak Online-Examination-System dbtables.sql inform -
CVE-2026-104110
FileRise: Unauthenticated disclosure of internal folder path -
CVE-2026-64856
FileRise: Missing Authentication Guard on File Snippet Previ -
CVE-2026-55682
WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie
V. Comments for CVE-2026-74047
No comments yet