Wazuh Manager: Improper session invalidation of API tokens for run_as users

Summary

Wazuh Manager 4.0.0 before 4.14.8 does not invalidate already issued API tokens for run_as users that have no static roles, because check_token never checks the token blacklist. An attacker with a revoked administrator grant can keep authenticating and re-add the administrator role to their own account, which makes the privileged access permanent. The attacker must already hold a privileged API session (PR:H), so the risk is mainly for former administrators, de-provisioned SSO users and insiders.

Affected

• Wazuh wazuh-manager 4.0.0 to before 4.14.8 (CNA range)
• The vendor advisory lists 4.0.0 to 4.14.7 and also mentions the main branch
• Affected deployments: run_as users with zero static roles, e.g. SSO or authorization-context setups with dynamically assigned roles

Fixed in

• Upgrade to Wazuh 4.14.8 or later (vendor release v4.14.8, 23 September 2026)
• Note: the 4.14.8 changelog does not explicitly name this fix; confirm with the vendor after upgrading

Workaround

• No vendor workaround documented.
• Interim measures (not vendor guidance): restrict manager API access to management networks; review administrator accounts and auth-context/run_as role mappings; check for administrator roles re-added after de-provisioning; reset credentials of users whose admin rights were revoked until the upgrade is verified

Exploitation

• CISA SSVC (via CNA): exploitation status poc, automatable no, technical impact total
• Public PoC status is contested: one national CSIRT (ACN) lists a PoC as available, another source states no public PoC
• One aggregator claims active exploitation, but no primary evidence was found
• Assume a PoC may exist

Our recommendation

• Patch all Wazuh 4.x managers to 4.14.8 or later, with priority for SSO or dynamic-role deployments
• Check whether the manager API is reachable from the internet or untrusted networks and restrict it
• Review administrator accounts and role assignments, and remove stale or re-added administrator roles
• Revoke existing API tokens (global revoke) after the upgrade and monitor API logs for unexpected role changes
• Treat the SIEM server as critical: API administrator access can lead to root on the manager

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Wazuh release v4.14.8 github.com
• Wazuh security advisory GHSA-3xm6-wp5v-2fm9 github.com
• VulnCheck advisory: Wazuh session invalidation bypass in check_token www.vulncheck.com
• ACN: available PoCs for vulnerabilities in Wazuh www.acn.gov.it
• NVD record via Vulners mirror vulners.com
• The Hacker Wire: CVE-2026-74037 www.thehackerwire.com
• Strix: CVE-2026-74037 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:32.