CVE-2026-74034 — Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command
Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_pat…
Published: 2026-10-13 · CVSS: 8.7 · CVSS 4.0
Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root, exfiltrating /etc/shadow and client.keys.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7