# CVE-2026-74034: Wazuh missing origin check in agent upgrade allows arbitrary file read

Source: https://junglewise.ai/threats/cve-2026-74034-wazuh-from-4-1-0-before-4-14-8-contains-a-missing-origin-check-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-74034 · Severity: high · CVSS 7.5 · Published 2026-10-13

Wazuh is a security monitoring platform that agents install on endpoints to send logs and telemetry to a central manager. A vulnerability in the manager's upgrade module allows enrolled agents to read any file on the manager as root—including password hashes, encryption keys, and API credentials—by injecting a specially crafted upgrade command. An attacker with network access to an anonymously enrolled agent can exfiltrate sensitive files in a single message, compromising the entire deployment.

Technologies: [Wazuh Manager](https://junglewise.ai/threats/technologies/wazuh-manager). Vendors: [Wazuh](https://junglewise.ai/threats/vendors/wazuh).

## Quick answers

**Is CVE-2026-74034 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-74034 being exploited in the wild.

**How severe is CVE-2026-74034?** High severity, with a CVSS score of 7.5, published 13 October 2026.

**Which products and versions are affected?** Wazuh Manager 4.1.0 to 4.14.7.

**Is there a fix for CVE-2026-74034?** Yes: fixed in 4.14.8. Until then: Restrict network access to the agent enrollment port (authd 1515) and agent communication port (remoted 1514) to trusted networks. Disable anonymous enrollment by configuring an enrollment password or client certificate requirement in the manager's authd configuration. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-74034 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-74034?** Check whether you run Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.14.8

Restrict network access to the agent enrollment port (authd 1515) and agent communication port (remoted 1514) to trusted networks. Disable anonymous enrollment by configuring an enrollment password or client certificate requirement in the manager's authd configuration.

## Technical details

The wm_agent_upgrade module processes upgrade commands from two sources (the API and wazuh-analysisd) without distinguishing between them, allowing agents to issue commands meant only for administrators. A missing path validation on the file_path parameter in upgrade_custom commands permits reading arbitrary files; the manager opens and streams the raw bytes back to the agent as root. Exploitation requires network access to enroll an agent and send one message; no authentication is needed on default deployments that allow passwordless enrollment.

## Affected products

- Wazuh wazuh-manager 4.1.0 to 4.14.7

## Timeline

- 2026-10-13: disclosed
- 2026-09-25: patched: v4.14.8 released

## References

- [https://github.com/wazuh/wazuh/releases/tag/v4.14.8](https://github.com/wazuh/wazuh/releases/tag/v4.14.8)
- [https://github.com/wazuh/wazuh/security/advisories/GHSA-r7hm-43xr-477j](https://github.com/wazuh/wazuh/security/advisories/GHSA-r7hm-43xr-477j)

## Related threats

- [Wazuh Manager SQL injection in WazuhDBBackend._substitute_params](https://junglewise.ai/threats/cve-2026-112341-wazuh-versions-from-4-0-0-before-4-14-9-contain-a-sql-injection)
- [Wazuh missing TLS hostname verification in fluent-forward module](https://junglewise.ai/threats/cve-2026-112339-wazuh-from-3-9-0-before-4-14-9-contains-a-missing-tls-hostname)
- [Wazuh GitHub module server-side request forgery in pagination](https://junglewise.ai/threats/cve-2026-112338-wazuh-from-4-3-0-before-4-14-9-contains-a-server-side-request)
- [Wazuh Manager memory leak in JSON decoder](https://junglewise.ai/threats/cve-2026-112336-wazuh-manager-from-3-0-0-before-4-14-9-contains-a-memory-leak)
- [Wazuh path traversal in get_list_file helper](https://junglewise.ai/threats/cve-2026-93347-wazuh-from-4-1-1-before-4-14-8-contains-a-path-traversal)