Advisory · CVE-2026-74037
Revoked Wazuh run_as tokens were not invalidated
Wazuh manager 4.0.0 through the releases before 4.14.8 did not properly invalidate revoked run_as tokens, so a former administrator's token may keep working. VulnCheck rates it CVSS 4.0 8.6.
- Vendor
- Wazuh
- Product
- Wazuh manager
- Identifier / CWE
- CVE-2026-74037
CWE-613 - Action timing
- Immediate
Explain it like I’m five
Firing the admin does not fire their token: revoked credentials stayed valid, so yesterday's access quietly remains today's access.
- 01Admin token issued
An administrator holds a run_as token for the Wazuh manager.
- 02Access revoked
The administrator's access is revoked, but the token is not invalidated.
- 03Token still works
The old token continues to authenticate with privileged effect.
What happened
Wazuh disclosed CVE-2026-74037 for the manager in releases 4.0.0 through those before 4.14.8. Revoked run_as tokens were not invalidated by the token-checking path, which can let a former administrator retain privileged access.
The vendor’s affected data marks 4.14.8 as the first unaffected release, so upgrading to 4.14.8 or later is the stated fix.
What to do
- Inventory every Wazuh manager deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Wazuh manager while remediation is underway, especially for internet-facing instances.
- Review application and server logs for successful run_as authentication for accounts that were disabled or removed, and tokens used from new locations.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Credential revocation that does not revoke is an offboarding failure with a CVE number. Upgrade, then force-rotate manager tokens for departed admins.