CVE-2026-74047GHSA-qj8j-r988-54rx
wazuh-manager: Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint
Wazuh wazuh-manager
CVSS
7.1HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 18 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.14.8wazuh-managerCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Attackers holding the default readonly role can request the auth component configuration for pseudo-agent ID 000 to obtain the secret and enroll rogue agents against the manager.
Text from CVE List
Affected versions 3
- wazuh-manageraffected: 4.0.0 before 4.14.8CVE List
- wazuh-managerunaffected: 4.14.8CVE List
- wazuh-manager>= 4.0.0GitHub