CVE-2026-74047Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint

Beschreibung

Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Attackers holding the default readonly role can request the auth component configuration for pseudo-agent ID 000 to obtain the secret and enroll rogue agents against the manager.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-qj8j-r988-54rx) vendor-advisory
• Wazuh v4.14.8 Release Notes patchrelease-notes
• VulnCheck Advisory: Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint third-party-advisory