CVE-2026-74040: Missing Authorization in Wazuh wazuh-manager
Description
Wazuh wazuh-manager versions from 3.9.0 up to but not including 4.14.8 have an arbitrary file overwrite vulnerability in the MasterHandler.process_files_from_worker component. This flaw allows a cluster worker with control to overwrite critical master files such as ossec.conf and agent.conf by exploiting a trailing-slash basename bypass and missing extra_valid enforcement. Successful exploitation can lead to root remote code execution on the manager and all connected agents.
CVSS v4.0
Score 9.4critical
Affected software
Wazuh
wazuh-manager
pkg:github/wazuh-managerRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-74040 is a critical vulnerability in Wazuh wazuh-manager affecting versions >=3.9.0 and <4.14.8. The vulnerability arises from insufficient authorization checks in the MasterHandler.process_files_from_worker function, permitting a malicious cluster worker to overwrite protected master configuration files. The exploit leverages a trailing-slash basename bypass combined with missing enforcement of extra_valid parameters, enabling attackers to overwrite ossec.conf and agent.conf files. This leads to root-level remote code execution on the manager and all agents in the cluster.
Potential Impact
An attacker controlling a cluster worker can overwrite critical configuration files on the master node, resulting in root remote code execution on both the manager and every connected agent. This compromises the entire Wazuh cluster's integrity and security, allowing full control over the affected systems.
Mitigation Recommendations
The vulnerability affects Wazuh wazuh-manager versions from 3.9.0 up to but not including 4.14.8. Users should upgrade to version 4.14.8 or later where this issue is fixed. Patch status is confirmed by the affectedVersions range indicating the fix is in 4.14.8. No vendor advisory content was provided, but the version range clearly indicates remediation by upgrade.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-14T14:06:40.512Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ace36e32cdf04f65668a6cd
Added to database: 10/13/2026, 13:49:23 UTC
Last enriched: 10/13/2026, 14:03:48 UTC
Last updated: 10/13/2026, 18:57:34 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.