Rate limit bypass via /events endpoint in Wazuh Manager (CVE-2026-33434)

A logic error in `CheckRateLimitsMiddleware.dispatch()` unconditionally overwrites the global rate limit check result with the /events endpoint-specific check result, discarding whether the global `max_request_per_minute` threshold was exceeded. When the global limit is surpassed, requests to /events continue to succeed as long as the endpoint-specific counter (hardcoded at 30 requests per minute) has not been reached. An authenticated user with `events:ingest` permission can exploit this to inject events into analysisd beyond the administrator-configured global rate limit. Affected versions: - >= 4.6.0 We recommend updating to: >= 4.14.5. CVSS 7.1 · our assessment: this_week Vendor advisory: https://github.com/wazuh/wazuh/security/advisories/GHSA-37qc-8242-6crg Details: https://vuln.today/cve/CVE-2026-33434