CVE-2026-74047

Executive Summary

CVE-2026-74047 is an information disclosure vulnerability in Wazuh (versions 4.0.0 through 4.14.7) that allows any authenticated user holding the low-privileged agent:read permission to retrieve the plaintext authd.pass enrollment password through an unmasked agent configuration endpoint. Because the default readonly role includes this permission, an attacker with even the most restricted default account can request the auth component configuration for pseudo-agent ID 000 and obtain the shared enrollment secret. Possession of this secret enables an attacker to enroll rogue agents against the Wazuh manager, establishing a persistent foothold within the monitored infrastructure.

Technical Analysis

The vulnerability resides in Wazuh's REST API and its interaction with the agent configuration subsystem. Wazuh managers distribute configuration to enrolled agents, including cluster-wide settings for the authentication daemon (authd), which governs agent enrollment. The enrollment secret authd.pass is a shared credential used by agents to authenticate to the manager's authd service and register themselves.

The core flaw is a secret-masking bypass on an API endpoint. The NVD description states the issue is an "unmasked agent configuration endpoint" that returns plaintext secrets instead of the redacted placeholder typically emitted for sensitive fields. Wazuh's API normally applies response filtering to sensitive values such as passwords, keys, and tokens. The affected configuration retrieval path fails to apply that masking for the auth component when queried against the pseudo-agent ID 000 — the identifier Wazuh uses to represent manager-level (global) configuration rather than a specific enrolled agent.

Access control is misconfigured relative to data sensitivity. The API's RBAC system assigns the agent:read permission to the default readonly role. This permission is intended only for reading agent metadata and configuration. Because the global auth configuration is reachable via the same agent-configuration endpoint family, the agent:read permission is sufficient to read a manager-wide secret. The result is a privilege boundary violation: a permission scoped to non-sensitive agent data exposes a credential whose scope is the entire manager.

The severity is amplified by the nature of the leaked secret. authd.pass is a reusable shared secret, not a per-agent token. It does not expire between enrollment operations, and rotating it requires an administrative change that invalidates it for all legitimate agents. A single successful disclosure therefore grants durable enrollment capability until an administrator performs credential rotation.

No public proof-of-concept, Nuclei template, or exploit code is available for this CVE. The mechanism described in the NVD text is an authorization/masking logic error rather than a memory-safety or injection defect, so exploitation requires only a valid low-privileged API session and a correctly formed configuration request. This lowers the practical skill barrier and increases the pool of potential attackers with access to any account provisioned with the default readonly role.

Exploitation Scenarios

1. Reconnaissance and target identification. The attacker identifies a reachable Wazuh manager REST API, typically listening on port 55000 (Agent 000). No public exploit exists, so identification relies on the exposed API service and its version banner. The attacker must already hold valid credentials for a user assigned the default readonly role, or a custom role that includes agent:read.

2. Triggering the flaw class. The vulnerability is a sensitive-data-exposure / missing-masking condition. The attacker issues a configuration-retrieval request against the agent configuration endpoint using the pseudo-agent ID 000 and the auth component. Because the endpoint returns the auth component configuration without applying the masking filter that protects secret fields, the response body contains the plaintext value of authd.pass. No privilege escalation, injection, or malformed input is required — the endpoint returns the secret to any caller with agent:read.

3. Payload/execution method. There is no payload in the traditional sense. The "execution" is the API call itself and the parsing of the response to extract the plaintext authd.pass value. No public PoC is available; the attack chain is inferred from the vulnerability class (CWE-200, exposure of sensitive information) and the endpoint behavior described by NVD. The attacker does not need to craft a special request beyond a valid authenticated query for pseudo-agent 000's auth configuration.

4. Post-exploitation impact. With the plaintext enrollment password in hand, the attacker can enroll rogue agents against the Wazuh manager. These attacker-controlled agents appear as legitimate endpoints in the Wazuh console, can receive configuration and rules, and provide the attacker with a trusted channel into the monitoring infrastructure. Rogue agents can be used for persistent access, data exfiltration through the monitoring pipeline, or to blend malicious activity with normal fleet telemetry. Because the secret is shared and reusable, the attacker retains enrollment capability until the password is rotated across the entire deployment.

Impact Assessment

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) yields a base score of 6.5, rated Medium. Network reachability (AV:N) with low attack complexity (AC:L) makes exploitation straightforward. The PR:L rating reflects the requirement for an authenticated low-privileged session, which in practice is a low bar given that the default readonly role qualifies. Confidentiality impact is High because the leaked authd.pass is a manager-wide shared secret granting enrollment authority. Integrity and availability impacts are None because the vulnerability itself only discloses data.

Business impact centers on the security monitoring platform itself. Wazuh is commonly deployed as a SIEM/XDR backbone across enterprise endpoints, servers, and cloud workloads. Compromise of the enrollment secret undermines the integrity of the monitored environment: rogue agents can inject false telemetry, suppress or dilute legitimate alerts, or establish a covert control channel. In regulated environments, disclosure of a credential used for infrastructure enrollment may constitute a reportable security incident independent of any downstream abuse. The blast radius extends to every agent enrollment operation that trusts the shared secret, meaning a single leaked value affects the entire manager's enrollment trust model until rotation.

Detection Guidance

Sigma Rule

title: Wazuh authd.pass Disclosure via Agent Configuration Endpoint (CVE-2026-74047)
id: 8f2a1c44-7b6e-4d3a-9f10-wazuh74047
status: experimental
description: Detects API requests to the Wazuh manager REST API that retrieve the auth component configuration for pseudo-agent 000, the access pattern used to disclose the plaintext authd.pass enrollment password.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-74047
author: Threat Intelligence Team
date: 2026/01/01
logsource:
  product: wazuh
  service: api
detection:
  selection_endpoint:
    url.path|contains:
      - '/agents/000/config/'
  selection_component:
    url.path|contains:
      - 'auth'
  selection_method:
    http.request.method: 'GET'
  condition: selection_endpoint and selection_component and selection_method
falsepositives:
  - Legitimate administrative retrieval of global auth configuration by privileged operators
level: high
tags:
  - attack.t1078
  - cve.2026-74047

YARA Rule

rule CVE_2026_74047_Wazuh_Authd_Pass_Disclosure
{
    meta:
        description = "Detects Wazuh API response or log artifacts containing disclosed authd.pass enrollment secret tied to agent 000 auth config retrieval"
        author = "Threat Intelligence Team"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-74047"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ep1 = "/agents/000/config/auth" ascii nocase
        $ep2 = "/agents/000/config/authd" ascii nocase
        $key1 = "authd.pass" ascii nocase
        $key2 = "auth" ascii nocase
        $key3 = "password" ascii nocase

    condition:
        (any of ($ep1, $ep2)) or ($key1 and any of ($key2, $key3))
}

Suricata IDS Rule

alert http any any -> any 55000 (msg:"CVE-2026-74047 Wazuh authd.pass Disclosure via agent 000 auth config"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/agents/000/config/"; http.uri; content:"auth"; nocase; classtype:attempted-recon; reference:cve,2026-74047; sid:202674047; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=30s
  [http where http.request.method == "GET" and url.path : "/agents/000/config/*"]
  [http where url.path : "*auth*" and http.response.status_code == 200]

Splunk SPL Query

index=wazuh sourcetype=wazuh:api OR sourcetype=wazuh:api-access
| search uri_path="/agents/000/config/*" uri_path="*auth*" http_method=GET
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as statuses by src_ip user
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="wazuh,api,cve-2026-74047,">
  <rule id="100740" level="12">
    <decoded_as>json</decoded_as>
    <field name="uri_path">/agents/000/config/</field>
    <field name="uri_path">auth</field>
    <description>CVE-2026-74047: Possible authd.pass disclosure - agent 000 auth configuration retrieved via API</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>information_disclosure,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description references "before 4.14.8" as the fixed boundary, but no vendor advisory, commit, or release artifact confirming 4.14.8 as the patched version was available from any tracked source. Treat as unpatched until a vendor advisory is verified.

1. Immediate mitigations.

   • Restrict network access to the Wazuh manager REST API (default port 55000) using firewall rules, security groups, or a reverse proxy so that only trusted management hosts can reach the endpoint.
   • Audit RBAC roles. Remove agent:read from any role that does not require it, and review whether the default readonly role is assigned to accounts that do not need agent data.
   • Rotate the authd.pass enrollment secret if there is any suspicion of unauthorized read access, and re-enroll legitimate agents as required.
   • Monitor API access logs for requests to the agent 000 configuration endpoint with the auth component, per the detection rules above.

2. Patch/upgrade steps.

   • Verify the Wazuh release notes and advisory channels for a version designated as fixing this CVE before applying changes. Upgrade to the confirmed fixed release (NVD references 4.14.8 as the upper boundary) once the vendor publishes and validates it.
   • Do not rely on the NVD version range alone; confirm masking behavior for auth configuration on agent 000 after any upgrade by testing with a low-privileged account.

3. Long-term hardening.

   • Apply least privilege to the Wazuh API: create purpose-specific roles and avoid granting broad read permissions by default.
   • Enforce response masking on all secret-bearing configuration fields and add regression tests that assert no plaintext secret is returned to non-privileged callers.
   • Enable API audit logging and forward it to an independent monitoring plane so that disclosure attempts are visible even if the Wazuh manager itself is subverted.
   • Implement credential rotation schedules for shared enrollment secrets and prefer per-agent identity mechanisms where supported.

References

• NVD — CVE-2026-74047: https://nvd.nist.gov/vuln/detail/CVE-2026-74047
• Wazuh Project / Wazuh documentation (vendor maintainer; check for advisory and release notes): https://wazuh.com
• Wazuh GitHub repository (verify commits and release tags for 4.14.8): https://github.com/wazuh/wazuh
• CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/

No threat actor campaigns or exploit-in-the-wild activity have been identified for this CVE. It is not listed in CISA KEV, and no public PoC, Nuclei template, or exploit code is available as of this report.