Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access.
Get the CyboWatch SIEM platform, hosting, and 24×7 SOC analysts. Send an enquiry, or call or email us to get started.