CVE-2026-74035 in Manager
Summary
by MITRE • 10/13/2026
Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the reserved user guard to take over the wazuh superuser account and authenticate with empty credentials.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Wazuh versions ranging from 4.6.0 up to but not including 4.14.8 represents a critical authentication bypass flaw rooted in improper input validation within the security.update_user endpoint. This issue stems from a logical error where the code responsible for enforcing reserved user guards and password policies is encapsulated within a conditional statement that relies on truthiness checks rather than explicit null or empty value detection. Specifically, when an administrator with delegated privileges attempts to update a user's credentials by submitting an empty string for the password field, the application fails to trigger the necessary security controls designed to prevent such modifications. This oversight allows the system to proceed with the update operation without validating that the new credential meets minimum complexity requirements or checking if the target account is protected against unauthorized changes.
From a technical perspective, this flaw aligns closely with CWE-287 Improper Authentication and CWE-601 URL Redirection to Untrusted Site in terms of logical flow errors leading to privilege escalation. The core issue lies in the application's failure to distinguish between an intentionally empty password field intended for removal or reset versus a malicious attempt to bypass security constraints by exploiting weak conditional logic. In many programming languages, empty strings can evaluate as falsy values, causing subsequent validation blocks that depend on non-empty inputs to be skipped entirely. Consequently, the reserved user guard mechanism, which is supposed to prevent modification of critical administrative accounts like the superuser, becomes ineffective when presented with this specific input vector. This allows a lower-privileged delegated administrator to manipulate high-level account settings without triggering alerts or rejecting the request based on policy violations.
The operational impact of this vulnerability is severe, as it enables an attacker who has obtained valid credentials for a delegated user administrator role to escalate privileges and take full control of the Wazuh superuser account. By authenticating with empty credentials after exploiting this flaw, the adversary gains unrestricted access to all security monitoring capabilities, log analysis features, and configuration management tools within the platform. This level of access allows the attacker to disable security alerts, tamper with detection rules, exfiltrate sensitive data collected by the agents, or install backdoors for persistent access. Given that Wazuh is often deployed as a central component in enterprise Security Information and Event Management architectures, compromising the superuser account effectively compromises the entire visibility and integrity of the organization's security posture.
This vulnerability maps to MITRE ATT&CK technique T1078 Valid Accounts, specifically focusing on Local Account manipulation for privilege escalation. The attacker leverages existing valid credentials with delegated administrative rights to perform unauthorized changes that elevate their standing within the system. To mitigate this risk, organizations running affected versions must immediately upgrade Wazuh to version 4.14.8 or later where the logical flaw has been corrected to properly enforce password policies and reserved user guards regardless of input truthiness. Additionally, until an upgrade is performed, administrators should restrict access to the security.update_user endpoint by implementing strict network-level controls such as IP whitelisting for management interfaces. It is also advisable to audit existing delegated administrator accounts to ensure they adhere to the principle of least privilege, minimizing the potential blast radius if a credential compromise occurs. Regularly reviewing and rotating administrative passwords further reduces the window of opportunity for exploitation should similar vulnerabilities be discovered in future releases.