CVE-2026-74034 in Wazuh
Summary
by MITRE • 10/13/2026
Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root, exfiltrating /etc/shadow and client.keys.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified within Wazuh versions ranging from 4.1.0 up to but not including 4.14.8 represents a critical authentication bypass mechanism located in the wm_agent_upgrade module. This component is responsible for managing agent upgrades, yet it fails to perform adequate validation of the origin or authorization context associated with incoming upgrade_custom commands. In a properly secured architecture, any command requesting system-level changes such as software installation or file replacement must be strictly authenticated and authorized by an administrator through secure channels. However, due to this missing origin check, enrolled agents are permitted to issue these high-privilege commands without sufficient verification of their legitimacy relative to the central manager's expectations. This architectural flaw effectively allows any entity possessing a valid agent key to interact with the upgrade subsystem as if it were an authorized administrative source.
The technical exploitation of this vulnerability centers on the ability of attackers to inject crafted messages into the communication channel between agents and managers or among agents themselves, depending on the specific deployment topology. By crafting an upgrade_custom command that includes attacker-controlled parameters for file_path, a malicious actor can manipulate the underlying system processes. Since these commands are executed with elevated privileges, typically root access in Linux-based environments, the lack of input validation allows for arbitrary file read operations. The agent process does not restrict the scope of files accessible during this custom upgrade procedure, thereby enabling direct reading of sensitive system artifacts that would otherwise be protected by standard operating system permissions.
The operational impact of this vulnerability is severe, primarily due to the potential for complete credential compromise and lateral movement within a monitored environment. Attackers can exploit this flaw to read critical configuration files such as /etc/shadow, which contains hashed password information, and client.keys, which holds the cryptographic keys used by agents to authenticate with the Wazuh manager. The exfiltration of these files allows adversaries to perform offline brute-force attacks against user passwords or potentially forge valid agent identities to impersonate legitimate nodes within the network. This undermines the integrity of the entire security monitoring infrastructure, as compromised credentials can be used to bypass further authentication mechanisms and establish persistent access without detection by standard logging tools that rely on those same keys for trust verification.
From a classification perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, specifically regarding the failure to verify the identity of an actor before granting privileges. It also relates closely to CWE-94, Code Injection, as it involves the manipulation of input parameters that influence system behavior in unintended ways. In terms of tactical mapping within the MITRE ATT&CK framework, this vulnerability facilitates Initial Access and Credential Access techniques. The ability to read /etc/shadow corresponds directly to T1003, specifically the OS Credential Dumping sub-technique, while the manipulation of agent keys supports persistence and privilege escalation strategies by allowing an attacker to maintain control over compromised systems under a trusted identity.
Mitigation for this issue requires immediate action to update all affected Wazuh installations to version 4.14.8 or later, where the origin check has been properly implemented in the wm_agent_upgrade module. Administrators should also review their network segmentation policies to ensure that agent communication channels are protected against unauthorized interception and injection of messages. Additionally, implementing strict file permission controls on sensitive files like /etc/shadow can provide a layer of defense-in-depth, although this is secondary to patching the application-level flaw. Regular auditing of upgrade logs and monitoring for anomalous custom command executions can help detect potential exploitation attempts in environments where immediate patching may be delayed due to operational constraints.