CVE-2026-74037
HIGH
NVD
CVSS Score
7.2
Severity
HIGH
Published
Oct 13, 2026
Vendor
unknown
Description
Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access.