Wazuh from version 4.0.0 up to 4.14.7 contains a flaw in the agent configuration API that allows an authenticated user with read‑only privileges to fetch the plaintext enrollment password stored in authd.pass. By requesting the configuration for the special pseudo‑agent ID 000, an attacker can read the secret, enabling the creation of rogue agents that can be enrolled in the manager under the attacker’s control. The vulnerability does not allow arbitrary code execution, but it grants complete credential theft for agent enrollment, which undermines the integrity and confidentiality of the deployment.

The impacted product is the Wazuh manager platform, version 4.0.0 to 4.14.7, for all operating systems supported by Wazuh. Any system running these versions and exposing the RESTful agent configuration endpoint is susceptible.

The vulnerability scores a moderate CVSS v3.1 base of 7.1 and is listed as not yet exploited in the CISA KEV catalog. The EPSS score is currently unavailable, suggesting limited data on real‑world exploitation. Attackers would need network access to the Wazuh manager and an account with the default readonly agent:read role, which are both commonly available within an internal network. The attack surface is the documented agent configuration endpoint, which is not protected by additional authentication beyond the existing role permissions. Therefore, the risk is significant for environments that rely on the default read‑only role or expose the API to untrusted users.