CVE-2026-74037 Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token
Attackers with revoked admin grants can bypass token invalidation to retain privileged access in Wazuh manager.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-74037?
CVE-2026-74037 is a high-severity authentication bypass vulnerability in wazuh-manager, published on 13 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access.
Weakness: CWE-613
Which versions are affected by CVE-2026-74037?
How do I fix CVE-2026-74037?
No fix has been published for CVE-2026-74037 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-74037 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-74037 exists.
Sources
Also known as GHSA-3xm6-wp5v-2fm9.