CVE-2026-74034

Executive Summary

CVE-2026-74034 is a missing-origin-check vulnerability in the Wazuh wm_agent_upgrade module affecting Wazuh versions from 4.1.0 before 4.14.8. Because the module does not validate the origin of incoming upgrade_custom messages on the agent channel, an enrolled agent (or an attacker who controls one) can supply an arbitrary file_path and cause the Wazuh manager, which runs as root, to read and return the contents of arbitrary files — including /etc/shadow and client.keys. The CVSS score is 7.5 (High) with Confidentiality:High, giving attackers a direct path to credential and key material exfiltration; no public exploit, PoC, or Nuclei template is currently known, and the issue remains unpatched per available evidence.

Technical Analysis

Wazuh is an open-source security platform consisting of a central manager (and indexer/dashboard) and lightweight agents deployed on monitored endpoints. Agents communicate with the manager over an authenticated channel; the manager accepts structured messages from agents and dispatches them to internal modules. One such module, wm_agent_upgrade, implements remote agent upgrade functionality — including upgrade_custom commands that instruct the manager to fetch an upgrade package from a location specified by the requesting agent.

The defect described by the CNA/NVD is a missing origin check (CWE-862, Missing Authorization). The wm_agent_upgrade module accepts upgrade_custom messages and processes the caller-supplied file_path value without verifying that the request originates from an authorized/trusted source or that the requested path is within an allowed upgrade-package directory. Because the module executes within the manager process context (running as root on the manager host), the manager opens and reads the attacker-specified path and returns its content to the requesting agent. This is effectively a server-side file-read primitive constrained only by the manager process's privileges (root) and reachable file paths.

Key technical properties derivable from the description:

• Attack surface: the agent↔manager communication channel; specifically the upgrade_custom message type handled by wm_agent_upgrade. No public-facing HTTP endpoint is required — the attacker needs to be able to send messages as an agent.
• Precondition: the attacker must be an enrolled agent (i.e., hold valid agent credentials/keys), or must have compromised one. This authentication requirement is why the vector is PR:N only in the sense that no additional manager-side privilege is needed once an agent identity exists — the "missing origin check" is the trust-boundary failure.
• Root cause class: absence of authorization/origin validation on a privileged server-side operation that acts on attacker-controlled input (file_path).
• Impact primitive: arbitrary file read as root. The NVD description explicitly names /etc/shadow (system password hashes) and client.keys (Wazuh agent authentication keys) as exfiltration targets.

No public PoC, exploit code, or Nuclei template is available. The exact wire format, function names, and message schema are not disclosed in the provided description and are therefore not asserted here.

Exploitation Scenarios

No public PoC is available; the following chain is inferred from the vulnerability class (missing authorization / arbitrary file read) and the description supplied.

1. Reconnaissance / target identification. The attacker identifies a Wazuh deployment and determines the manager version is in the affected range (4.1.0 through 4.14.7). Version disclosure may be obtained from the dashboard, agent enrollment responses, or from network fingerprinting of agent channel ports.

2. Agent enrollment or agent compromise. The attacker obtains a valid enrolled-agent identity. Sources for this include: an agent they legitimately administer within the same environment, a stolen agent key, or a compromised endpoint already running an agent in the target deployment. This step supplies the authenticated channel over which wm_agent_upgrade messages are accepted.

3. Triggering the flaw. The attacker injects an upgrade_custom message over the agent channel, setting the file_path field to an arbitrary absolute path of interest (for example /etc/shadow or client.keys). Because wm_agent_upgrade does not perform an origin check, the manager processes the request as though it were legitimate, opens the referenced file with root privileges, and returns its contents.

4. Post-exploitation impact. With /etc/shadow the attacker obtains password hashes for offline cracking (potentially yielding root or other privileged credentials on the manager host). With client.keys the attacker harvests agent authentication keys, which can enable impersonation of other agents or broader access to the agent channel. The result is credential and key material compromise of the central Wazuh manager — a high-value pivot point in a monitored environment.

Because the file read is performed by the root-level manager process, the primitive is not limited to the two named files; those are simply the ones explicitly called out in the NVD description as high-value exfiltration targets.

Impact Assessment

• Confidentiality: High (C:H). Arbitrary root-context file read on the Wazuh manager. Explicitly enables exfiltration of /etc/shadow and client.keys.
• Integrity: None (I:N) and Availability: None (A:N) per the CVSS vector — the described primitive is a read, not a write or destructive operation.
• Attack Vector: Network (AV:N), Attack Complexity: Low (AC:L), Privileges Required: None (PR:N), User Interaction: None (UI:N), Scope: Unchanged (S:U). The overall base score is 7.5 (High).
• Blast radius: the manager is the trust anchor for the entire Wazuh deployment. Compromise of client.keys can undermine the integrity of the agent channel across the estate, and harvested /etc/shadow hashes can lead to further credential compromise beyond Wazuh itself.
• Business impact: exposure of platform credentials and system hashes in a security-monitoring product can cascade into downstream breaches; SOC data integrity and agent-trust assumptions are impacted. No integrity or availability loss is intrinsic to the flaw, so operational disruption is secondary to data compromise.

Detection Guidance

Sigma Rule

title: Wazuh Agent Upgrade Custom Arbitrary File Read Attempt
id: 8f2a1c74-3d5e-4b19-9c7a-2e6f0b1a9d33
status: experimental
description: Detects abuse of wm_agent_upgrade upgrade_custom messages with suspicious file_path values targeting sensitive files on the Wazuh manager (CVE-2026-74034).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-74034
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: wazuh
  service: manager
detection:
  selection_action:
    action|contains: 'upgrade_custom'
  selection_path:
    file_path|contains:
      - '/etc/shadow'
      - '/etc/passwd'
      - '/client.keys'
      - 'client.keys'
      - '/etc/sudoers'
      - '/root/.ssh'
  condition: selection_action and selection_path
falsepositives:
  - Legitimate custom upgrade packages stored in non-standard paths
level: critical

YARA Rule

rule CVE_2026_74034_Wazuh_UpgradeCustom_FileRead
{
    meta:
        description = "Detects upgrade_custom messages referencing sensitive paths characteristic of CVE-2026-74034 (Wazuh wm_agent_upgrade missing origin check)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-74034"
        date = "2026-01-01"

    strings:
        $a = "upgrade_custom" nocase
        $b = "wm_agent_upgrade" nocase
        $c = "file_path" nocase
        $d = "/etc/shadow" nocase
        $e = "client.keys" nocase
        $f = "/etc/passwd" nocase

    condition:
        ($a or $b) and $c and ($d or $e or $f)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET 1514 (msg:"CVE-2026-74034 Possible Wazuh wm_agent_upgrade upgrade_custom Arbitrary File Read"; flow:established,to_server; content:"upgrade_custom"; nocase; content:"file_path"; nocase; distance:0; pcre:"/file_path[^\n]{0,64}(\/etc\/shadow|client\.keys|\/etc\/passwd)/i"; classtype:attempted-recon; reference:cve,2026-74034; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-74034; sid:202674034; rev:1;)

Elastic Detection

sequence by host.name, agent.id with maxspan=30s
  [any where process.name == "wazuh-modulesd" and process.args : "*upgrade_custom*"]
  [file where event.category == "file" and file.path : ("/etc/shadow", "/etc/passwd", "*/client.keys", "/etc/sudoers")]

Splunk SPL Query

index=wazuh sourcetype="wazuh:manager" OR sourcetype="wazuh:alerts"
(upgrade_custom OR "wm_agent_upgrade")
(file_path="*shadow*" OR file_path="*client.keys*" OR file_path="*passwd*" OR message="*upgrade_custom*")
| stats count min(_time) as first_seen max(_time) as last_seen values(file_path) as paths by agent.id, agent.name, src_ip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="wazuh,manager,vulnerability,">
  <rule id="100740" level="12">
    <decoded_as>json</decoded_as>
    <field name="action">upgrade_custom</field>
    <regex type="pcre2">(?i)file_path[^}]*(\/etc\/shadow|client\.keys|\/etc\/passwd|\/etc\/sudoers)</regex>
    <description>CVE-2026-74034: Possible abuse of wm_agent_upgrade upgrade_custom with sensitive file_path</description>
    <mitre>
      <id>T1005</id>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_74034,ce_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Treat the fixed-version boundary as advisory only: the description states the issue exists "before 4.14.8," but no vendor patch, commit, or CVE-to-changelog mapping was provided in the data. Verify the availability of 4.14.8 through official Wazuh release channels before relying on it as a complete fix.
   • Restrict which agents can invoke upgrade functionality. Audit enrolled agents and confirm that only trusted, expected agents hold valid keys. Rotate agent keys (client.keys) as a precaution if unauthorized enrollment is suspected.
   • Network-segment the agent channel: limit which hosts can reach the manager's agent communication port and monitor for anomalous upgrade_custom traffic.
   • Enable and monitor manager-side logging for wm_agent_upgrade activity; alert on any upgrade_custom request referencing sensitive paths.
   • Apply least privilege where possible: ensure the manager process's filesystem access is constrained so that even if the origin check is bypassed, sensitive files like /etc/shadow are not trivially readable.

2. Patch / upgrade steps

   • Upgrade Wazuh to the version that includes the origin check (per the description, 4.14.8 or later). Since patch confidence is 0/4, confirm the fix against the official vendor advisory and release notes before deployment.
   • Stage upgrades in a test environment first; validate that upgrade_custom now enforces an origin/authorization check.
   • After upgrade, rotate exposed secrets: agent keys and any credentials whose hashes may have been read.

3. Long-term hardening

   • Adopt a formal authorization model for all privileged manager operations, with explicit origin validation on every agent-originated command.
   • Enforce strict allow-listing of paths for any operation that references files by path.
   • Implement continuous monitoring/alerting for arbitrary-file-read indicators and track Wazuh security advisories.
   • Apply defense-in-depth: run the manager with minimal necessary privileges, harden file permissions, and use detections (see Detection Guidance) to catch exploitation attempts.

References

• NVD — CVE-2026-74034: https://nvd.nist.gov/vuln/detail/CVE-2026-74034
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• Wazuh official documentation and release notes (verify the 4.14.8 fix and any associated security advisory): https://documentation.wazuh.com/
• Wazuh GitHub repository / release page (patch verification): https://github.com/wazuh/wazuh/releases

Note on exploitation status: No public PoC, exploit code, or Nuclei template is available for CVE-2026-74034, and it is not listed in CISA KEV at the time of writing. No threat-actor campaign or exploit-in-the-wild evidence was supplied in the source data.