CVE-2026-74047: 
Wazuh Server vulnerability analysis and mitigation

CVE-2026-74047 is an information disclosure vulnerability in Wazuh Manager that allows low-privileged users to retrieve the plaintext authd.pass enrollment password via an unmasked agent configuration API endpoint. It affects Wazuh versions 4.0.0 through 4.14.7, and was disclosed on October 13, 2026. The vulnerability was reported by researcher 5kr1pt and assigned by VulnCheck. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-522 (Insufficiently Protected Credentials). Wazuh's API includes a mask_sensitive_config() decorator that redacts authd.pass from the manager-facing endpoint (GET /manager/configuration/auth/auth), but this masking was never applied to the per-agent configuration endpoint (GET /agents/{agent_id}/config/{component}/{configuration}). Because agent ID 000 is the reserved pseudo-agent representing the manager itself, and it is explicitly added to the valid agent ID set in get_agents_info(), any user with the agent:read permission — granted by default to the built-in readonly role — can request GET /agents/000/config/auth/auth and receive the plaintext authd.pass secret. The masking fix was introduced in v4.10.4 (PR #34128) but only patched manager.py, leaving agent.py unprotected through at least v4.14.6 (GitHub Advisory).

Successful exploitation allows any user with the default readonly role to obtain the plaintext authd.pass enrollment password when password-based enrollment (auth.use_password: yes) is enabled — which is the Wazuh-recommended configuration. With this secret, an attacker can register rogue agents against the Wazuh manager, potentially feeding falsified security event data to the SIEM, undermining detection integrity, or using the manager's trust relationships with enrolled agents as a pivot point for further lateral movement. The confidentiality impact is high, as the exposed credential is a shared secret governing the entire agent enrollment process (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, exploitation is straightforward: it requires only a valid low-privileged account with the default readonly role and a single authenticated API request, with no special tooling needed (Feedly, GitHub Advisory).

1. Reconnaissance: Identify a Wazuh Manager instance running version 4.0.0–4.14.7 with password-based enrollment enabled (auth.use_password: yes in ossec.conf).
2. Obtain low-privileged credentials: Acquire or create a Wazuh API user account assigned the built-in readonly role (role ID 2), which grants agent:read by default. This could be achieved through social engineering, credential reuse, or insider access.
3. Authenticate to the API: Send a POST request to /security/user/authenticate with the low-privileged credentials to obtain a JWT token.
4. Request the unmasked configuration: Issue an authenticated GET request to /agents/000/config/auth/auth using the obtained token. The response will include authd.pass in plaintext.
5. Enroll a rogue agent: Use the retrieved authd.pass secret with wazuh-authd or the agent enrollment process to register an unauthorized agent against the manager, enabling data manipulation or further pivoting (GitHub Advisory).

• Logs: Wazuh API access logs showing authenticated GET requests to /agents/000/config/auth/auth from unexpected users or IP addresses; repeated authentication attempts by readonly-role accounts followed by this specific endpoint access.
• Network: API calls to the agent configuration endpoint using agent ID 000 from hosts that are not Wazuh administrators or automation systems.
• Wazuh Manager: Unexpected new agent enrollments appearing in the manager, particularly from hosts not previously monitored or from unusual network segments, which may indicate rogue agent registration using the stolen authd.pass.
• File System: Review etc/authd.pass modification timestamps; if the file was recently accessed outside of normal administrative windows, it may indicate exploitation (GitHub Advisory).

Upgrade Wazuh Manager to version 4.14.8 or later, which applies mask_sensitive_config() to the per-agent configuration endpoint or adds an id == '000' guard consistent with other sensitive methods in the codebase (Wazuh Release). As an interim workaround, restrict API access so that readonly-role users cannot reach the /agents/{agent_id}/config/ endpoint, or temporarily disable password-based enrollment (auth.use_password: no) if operationally feasible. Additionally, rotate the authd.pass secret immediately if exposure is suspected, and audit API access logs for unauthorized requests to /agents/000/config/auth/auth (GitHub Advisory).

The vulnerability was reported by researcher 5kr1pt and published via GitHub Security Advisory GHSA-qj8j-r988-54rx on October 13, 2026. The advisory notes that the masking fix introduced in v4.10.4 was incomplete, highlighting a gap in security review coverage for the agent configuration code path. No significant broader media coverage or notable social media commentary has been identified beyond standard vulnerability database aggregation (GitHub Advisory).