What is the CVSS score of CVE-2026-33434?

CVE-2026-33434 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of Wazuh are affected by CVE-2026-33434?

Wazuh server API versions 4.6.0 through 4.14.4 contain a rate-limit bypass vulnerability that allows authenticated users to inject unlimited events into the analytics engine, circumventing…

How to fix or mitigate CVE-2026-33434?

Within 24 hours, identify all systems running Wazuh versions 4.6.0-4.14.4 using deployment tools or configuration management, and audit API access logs for suspicious event injection patterns from authenticated accounts. Within 7 days, restrict API endpoint access to trusted IP ranges, reduce the number of active authenticated API credentials to least-privilege scope, and implement monitoring or rate-limiting at the network layer on the /events endpoint. Within 30 days, contact Wazuh support to confirm patch timeline for version 4.14.5 or later and plan a staged upgrade in non-production environments first, validating that rate-limiting behavior is restored.

Wazuh CVE-2026-33434

HIGH

Improper Control of Interaction Frequency (CWE-799)

2026-07-17 security-advisories@github.com

Wazuh Code Injection

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

vuln.today AI

7.1 HIGH

Network-reachable API with low complexity but requires authenticated access (PR:L); primary harm is event-injection integrity (I:H) with minor analysisd load (A:L) and no confidentiality impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Updated

Jul 20, 2026 - 02:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 20, 2026 - 02:22 vuln.today

cvss_changed

Severity Changed

Jul 20, 2026 - 02:22 NVD

MEDIUM HIGH

CVSS changed

Jul 20, 2026 - 02:22 NVD

4.3 (MEDIUM) 7.1 (HIGH)

Analysis Generated

Jul 17, 2026 - 00:29 vuln.today

DescriptionNVD

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.6.0 and above, prior to 4.14.5, a logic error in CheckRateLimitsMiddleware.dispatch() causes the /events endpoint rate check to unconditionally overwrite the general rate limit result. When the global max_request_per_minute is exceeded, requests to /events still succeed if the events-specific counter (hardcoded 30/min) has not been reached. This allows event injection into analysisd beyond the admin-configured global rate limit. This issue has been fixed in version 4.14.5.

AnalysisAI

Rate-limit bypass in the Wazuh server API (versions 4.6.0 up to but not including 4.14.5) lets an authenticated client inject events into analysisd beyond the administrator-configured global request cap. A logic error in CheckRateLimitsMiddleware.dispatch() makes the /events endpoint's hardcoded 30/min check overwrite the general max_request_per_minute result, so /events requests keep succeeding even after the global limit is exhausted. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and CISA SSVC records no known exploitation.

Technical ContextAI

Wazuh is an open-source security monitoring platform (SIEM/XDR) whose server exposes a REST API; the /events endpoint feeds raw security events into analysisd, the core log-analysis and correlation daemon that generates alerts. Incoming requests pass through CheckRateLimitsMiddleware, which is meant to enforce both a global operator-set rate (max_request_per_minute) and an endpoint-specific limit. The flaw is CWE-799 (Improper Control of Interaction Frequency): dispatch() computes the general rate-limit decision and then unconditionally overwrites it with the /events-specific counter result (a hardcoded 30/min), so a breach of the global limit is masked whenever the events-specific counter is still under budget. The affected component is the Python API middleware in the Wazuh server (cpe:2.3:a:wazuh:wazuh), not the agent.

RemediationAI

Vendor-released patch: 4.14.5 - upgrade the Wazuh server/manager to version 4.14.5 or later, which corrects CheckRateLimitsMiddleware.dispatch() so the /events check no longer overwrites the global rate-limit decision; see the advisory at https://github.com/wazuh/wazuh/security/advisories/GHSA-37qc-8242-6crg. If immediate upgrade is not possible, reduce exposure by tightening who can authenticate to the API and reach the /events endpoint: restrict API access to trusted management hosts via network ACLs or firewall rules, minimize and audit API roles/tokens that can post events (removing the privilege from integration accounts that do not need it), and monitor analysisd ingestion rates for anomalous spikes that indicate limit bypass. These compensating controls limit reach but do not restore correct rate-limit enforcement, so they are stopgaps until 4.14.5 is deployed.