CVE-2026-74035

Executive Summary

CVE-2026-74035 is an authentication bypass vulnerability affecting Wazuh versions from 4.6.0 before 4.14.8. The flaw resides in the security.update_user component, where the reserved user guard and password policy enforcement are incorrectly placed inside a falsy truthiness check, allowing an empty password to bypass validation. A delegated user administrator can exploit this to take over the reserved wazuh superuser account and authenticate with empty credentials, achieving full administrative control of the Wazuh platform.

Technical Analysis

The vulnerability is classified as CWE-863: Incorrect Authorization. The core issue lies in the security.update_user function within the Wazuh API. According to the NVD description, the reserved user guard and password policy checks are wrapped inside a falsy truthiness condition. In many programming languages, an empty string evaluates to false in boolean contexts. Consequently, when an empty password is supplied to the user update endpoint, the truthiness check fails, and the security controls (reserved user guard and password policy) are skipped entirely.

This design flaw means that the validation logic is not executed when the password field is empty. The reserved user guard, intended to prevent modification of the built-in wazuh superuser account, is bypassed. The password policy, which should enforce minimum complexity or non-empty passwords, is also bypassed. As a result, an attacker with delegated user administrator privileges can update the wazuh superuser account's password to an empty value.

The attack surface is the Wazuh API, which is typically exposed on port 55000. Authentication is required to reach the security.update_user endpoint, but the attacker only needs delegated user administrator permissions, not full superuser access. The vulnerability allows privilege escalation from a delegated administrator to the superuser account. The CVSS vector indicates network exploitability (AV:N), low attack complexity (AC:L), and high privileges required (PR:H), with high impact on confidentiality, integrity, and availability.

The root cause is a logic error in the authorization check. The condition likely resembles if (password && !isReservedUser(user)) or similar, where the check is only performed if the password is provided. By omitting the password, the attacker bypasses the guard. The fix in version 4.14.8 presumably restructures the condition to always enforce the reserved user guard and password policy regardless of the password value.

No public proof-of-concept or exploit code is available. The attack chain is inferred from the vulnerability class and the NVD description.

Exploitation Scenarios

1. Reconnaissance and target identification: The attacker identifies a Wazuh instance with version between 4.6.0 and 4.14.7. This can be done via Shodan using dorks like product:Wazuh or by scanning for port 55000. The attacker must have valid credentials for a delegated user administrator account. This could be obtained through phishing, credential stuffing, or insider access.

2. Triggering the flaw: The attacker sends a request to the Wazuh API endpoint for security.update_user, targeting the reserved wazuh superuser account. The request includes an empty password field. Because of the falsy truthiness check, the reserved user guard and password policy are not evaluated. The API processes the update, setting the superuser password to an empty string.

3. Payload/execution method: The attack is a direct API call. The attacker uses the Wazuh API, likely via HTTP PUT or POST to the security.update_user endpoint. The payload contains the user ID of the wazuh account and an empty password parameter. No special encoding or injection is required; the bypass is due to the logic flaw.

4. Post-exploitation impact: After successfully setting an empty password, the attacker can authenticate as the wazuh superuser with an empty password. This grants full administrative control over the Wazuh platform, including access to all security events, configuration, agent management, and the ability to modify rules, decoders, and integrations. The attacker could disable security monitoring, exfiltrate sensitive data, or use the Wazuh server as a pivot point into the monitored environment.

No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

The CVSS score is 7.2 (High). The vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H indicates:

• Confidentiality (C:H): Full access to all security event data, logs, and configuration.
• Integrity (I:H): Ability to modify any Wazuh configuration, rules, and user accounts.
• Availability (A:H): Potential to disrupt monitoring, delete agents, or disable the platform.
• Scope (S:U): The impact is confined to the Wazuh security scope.
• Privileges Required (PR:H): The attacker must already have delegated user administrator privileges.

The blast radius includes the entire Wazuh deployment and all monitored endpoints. An attacker with superuser access can manipulate security monitoring, cover their tracks, and potentially move laterally to other systems managed by Wazuh. The vulnerability is particularly dangerous in environments where Wazuh is used for compliance and security monitoring, as an attacker could disable alerts and evade detection.

Detection Guidance

Sigma Rule

title: Wazuh Authentication Bypass via Empty Password in security.update_user
id: 8f2c1a3e-4b5d-6f7a-8e9b-0c1d2e3f4a5b
status: experimental
description: Detects attempts to exploit CVE-2026-74035 by updating the reserved wazuh user with an empty password.
author: Threat Intelligence
date: 2026-01-01
logsource:
    product: wazuh
    service: api
detection:
    selection:
        endpoint: '/security/users/*'
        method: 'PUT'
        user_id: 'wazuh'
        password: ''
    condition: selection
falsepositives:
    - Legitimate administrative actions that accidentally send empty password (unlikely)
level: critical
tags:
    - attack.t1190
    - cve.2026.74035

YARA Rule

rule CVE_2026_74035_Wazuh_Empty_Password_Bypass
{
    meta:
        description = "Detects Wazuh API requests attempting to update the wazuh user with an empty password"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-74035"
        severity = "critical"
    strings:
        $endpoint = "/security/users/"
        $user = "wazuh"
        $empty_pass = "\"password\":\"\""
        $empty_pass2 = "\"password\": \"\""
    condition:
        any of ($endpoint) and $user and any of ($empty_pass*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-74035 Wazuh Authentication Bypass Attempt - Empty Password for wazuh User"; flow:to_server,established; content:"/security/users/"; http_uri; content:"wazuh"; http_uri; content:"password"; http_client_body; content:"\"password\":\"\""; http_client_body; classtype:attempted-admin; sid:1000001; rev:1; reference:cve,2026-74035;)

Elastic Detection

process where event.type == "start" and
  process.name : "wazuh-api" and
  process.args : "*security.update_user*" and
  process.args : "*wazuh*" and
  process.args : "*password*"

Splunk SPL Query

index=wazuh_api sourcetype=wazuh:api
| search endpoint="/security/users/*" method="PUT" user_id="wazuh" password=""
| table _time, src_ip, user, user_id, endpoint, status

Wazuh OSSEC Rule

<group name="wazuh_api,">
  <rule id="100100" level="12">
    <decoded_as>json</decoded_as>
    <field name="endpoint">/security/users/.*</field>
    <field name="method">PUT</field>
    <field name="user_id">wazuh</field>
    <field name="password">^$</field>
    <description>CVE-2026-74035: Attempt to update wazuh superuser with empty password</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict network access to the Wazuh API (port 55000) to trusted IP addresses only.
   • Limit the number of delegated user administrator accounts and enforce least privilege.
   • Monitor API logs for any attempts to update the wazuh user, especially with empty passwords.
   • Implement additional authentication controls such as mutual TLS for API access if supported.
   • Consider disabling the delegated user administrator role until a patch is available.

2. Patch/upgrade steps:

   • Monitor the Wazuh project for an official security advisory and patch. The NVD description suggests the fix is in version 4.14.8, but no patch source is confirmed.
   • Once a patched version is available, upgrade all Wazuh components (manager, indexer, dashboard) to the latest version.
   • Verify the fix by testing that empty passwords cannot be set for the wazuh user.

3. Long-term hardening:

   • Enforce strong password policies at the application level and validate them server-side.
   • Implement code review processes focusing on authorization logic and truthiness checks.
   • Regularly audit user roles and permissions, especially for privileged accounts.
   • Use security headers and API rate limiting to reduce attack surface.
   • Conduct penetration testing against the Wazuh API to identify similar bypasses.

References

1. NVD - CVE-2026-74035: https://nvd.nist.gov/vuln/detail/CVE-2026-74035
2. Wazuh GitHub Repository: https://github.com/wazuh/wazuh
3. Wazuh Documentation - API Reference: https://documentation.wazuh.com/current/user-manual/api/index.html
4. CWE-863: Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
5. Wazuh Security Advisories: https://wazuh.com/security/ (no specific advisory confirmed)