Wazuh Manager CVE-2026-74047

Requires an authenticated Wazuh API session holding the agent:read permission, which is granted by the built-in default readonly role - so in practice any provisioned low-privilege operator account qualifies. The attacker must query the agent configuration endpoint for the manager's pseudo-agent ID 000 to retrieve the auth (authd) component configuration. Exploitation is meaningful only where password-based agent enrollment is configured (an authd.pass secret exists) on a manager in the 4.0.0-4.14.7 range; deployments using other enrollment mechanisms have no secret to leak. The limiting factors are the need for valid (even if low-privilege) API credentials and the presence of a configured enrollment password - it is not exploitable by a fully unauthenticated attacker.

This is a credible, moderate-priority information-disclosure issue rather than a critical remote-code-execution emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scoring 7.1 HIGH is internally consistent with the description: network-reachable, low-complexity, requiring low privileges (PR:L) and no user interaction, with high confidentiality impact and no integrity or availability impact - matching a read-only secret leak via an API endpoint. The key aggravating factor is that the required privilege is the DEFAULT readonly role's agent:read permission, so the 'low privilege' barrier is minimal in any multi-user Wazuh deployment. The downstream consequence is more serious than a simple read: the leaked authd.pass enrollment password enables enrolling rogue agents against the manager, which can poison the monitored estate - this lateral impact is not reflected in the base confidentiality-only score. No EPSS score was provided, and the input shows no CISA KEV listing and no public POC, so there is no public exploit identified at time of analysis. The absence of exploitation telemetry, combined with the authentication requirement, suggests this is not yet a mass-exploitation target. Reported by VulnCheck with a vendor advisory (GHSA-qj8j-r988-54rx) and a confirmed patch (v4.14.8), making the core facts well-sourced.

An attacker who holds any low-privileged Wazuh API account with the default readonly role (agent:read) calls the agent configuration endpoint for pseudo-agent ID 000 and receives the auth component configuration with the authd.pass field unmasked. They read the plaintext enrollment password and use it to enroll attacker-controlled rogue agents against the manager. No public exploit code is identified at time of analysis, but the attack requires only a standard authenticated API request.