Wazuh Manager CVE-2026-74039

Two conditions must both be true: (1) the attacker must hold a valid Wazuh API credential - exploitation is authenticated, PR:L per the CVSS 4.0 vector; and (2) the allow_run_as flag must be explicitly enabled for that account in Wazuh RBAC configuration - this is a non-default, operator-configured permission. Network reachability to the Wazuh Manager API port (default 55000) is also required (AV:N). Accounts without allow_run_as cannot reach the vulnerable code path even with valid credentials. Organizations that have not enabled allow_run_as for any account, or that restrict API port access to trusted internal networks, face materially lower risk than the CVSS score alone suggests.

CVSS 4.0 scores this 7.1 with AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H, accurately reflecting that the endpoint is network-reachable, requires only low-privilege credentials (an authenticated account with allow_run_as), and produces high availability impact. The vulnerability is not listed in CISA KEV and no EPSS data was provided, indicating no confirmed active exploitation at time of analysis. Real-world risk is moderate rather than critical: the attacker pool is bounded to accounts explicitly granted the allow_run_as permission flag, which is an opt-in RBAC setting. In multi-tenant or MSSP deployments where many analysts hold run_as rights, this boundary shrinks significantly. The attack is trivially automatable once credentials are in hand, and repeated submissions compound the impact. Organizations that do not use the run_as feature at all are not exploitable at the application layer regardless of patch status.

An attacker holding a Wazuh API account with allow_run_as enabled sends a loop of POST /security/user/authenticate/run_as requests, each with a JSON body containing thousands of levels of nesting such as {"a":{"a":{"a":...}}}. The API framework recursively traverses the full structure on every request with no depth bound, pegging CPU on the Wazuh Manager process. Within seconds, the API becomes unresponsive to all other users - dashboards, integrations, and automated SIEM workflows - until the process is restarted.