Wazuh CVE-2026-33434

Exploitation requires an authenticated caller (CVSS PR:L) able to reach the Wazuh server API /events endpoint over the network, and the target must run an affected version between 4.6.0 and 4.14.4. The specific trigger is sending /events requests after the operator-configured global max_request_per_minute has been exceeded while the hardcoded events-specific 30/min counter remains unmet, at which point the logic error allows the request through. Limiting factors: valid API authentication/authorization is needed (no anonymous exploitation), the impact is confined to bypassing rate limiting and injecting events into analysisd rather than code execution or data theft, and deployments that already restrict API network access or issue few event-posting credentials materially reduce exposure.

This is a moderate, mostly integrity-focused issue rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, I:H/A:L, C:N, 7.1) indicates network-reachable, low-complexity exploitation but requires existing privileges (PR:L), meaning an already-authenticated API client is needed rather than an anonymous attacker. All exploitation signals point the same direction and are consistent: EPSS is low at 0.21% (12th percentile), CISA SSVC scores Exploitation=none, Automatable=no, and Technical Impact=partial, and no KEV listing or public POC exists. The realistic harm is flooding analysisd with more events than the operator intended, undermining rate-limit-based protections and potentially degrading detection fidelity or availability; it does not by itself grant code execution or data disclosure. Because the attacker must already hold valid API credentials, the practical risk is elevated mainly where API tokens/roles are broadly issued or where a lower-privileged integration account is compromised.

An attacker holding a low-privileged but valid Wazuh API credential (or one who has compromised an integration account) scripts POST requests to /events, deliberately exceeding the administrator's global max_request_per_minute. Because the middleware masks the global-limit breach behind the events-specific 30/min counter, the excess events are accepted and forwarded to analysisd. No public POC is known, but exploitation is low-complexity (AC:L) and requires only network access plus existing authentication.