Session Invalidation Bypass in Wazuh by Threat Actor with Revoked Access
CVE-2026-74037

8.6HIGH

Key Information:

Vendor

Wazuh

Status
Wazuh-manager
Vendor
CVE Published:
13 October 2026

What is CVE-2026-74037?

The Wazuh platform fails to properly invalidate access tokens for users assigned with no static roles in versions prior to 4.14.8. This oversight allows attackers, even after having their administrator grants revoked, to authenticate and re-establish the administrator role, thereby maintaining illicit privileged access indefinitely. The issue arises because the token verification function neglects to reference a blacklist of revoked tokens, exposing systems to potential unauthorized control.

Affected Version(s)

wazuh-manager 4.0.0 < 4.14.8

wazuh-manager 4.14.8

References

https://github.com/wazuh/wazuh/security/advisories/GHSA-3...
vendor-advisory
https://github.com/wazuh/wazuh/releases/tag/v4.14.8
patchrelease-notes
https://www.vulncheck.com/advisories/wazuh-4.0.0-before-4...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

TarPeg007
vikman90
.