Skip to main content

Wazuh Manager CVE-2026-74039

| EUVDEUVD-2026-61075 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-08-18 VulnCheck
Denial Of Service Wazuh Wazuh Manager
7.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-reachable endpoint requires low-privilege authenticated account with allow_run_as; only availability is impacted with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 18, 2026 - 18:03 vuln.today
Analysis Generated
Aug 18, 2026 - 18:03 vuln.today
CVE Published
Aug 18, 2026 - 17:26 cve.org
HIGH 7.1

DescriptionCVE.org

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow_run_as enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/run_as endpoint. Attackers can repeatedly submit malformed auth_context bodies with unlimited nesting depth to cause the API framework to consume excessive CPU, denying service to all other API consumers.

AnalysisAI

CPU exhaustion in Wazuh Manager 4.0.0-4.14.6 and 5.0.0-beta2 allows authenticated API users with the allow_run_as permission to fully deny service to all other API consumers by submitting arbitrarily deeply nested JSON to the POST /security/user/authenticate/run_as endpoint. The API framework processes these structures recursively without any depth or size limit, consuming CPU proportionally to nesting depth until the process becomes unresponsive. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain Wazuh API credentials with allow_run_as
Delivery
Send repeated POST /security/user/authenticate/run_as requests
Exploit
Submit JSON body with unlimited nesting depth
Execution
API recursively processes structure without size limit
Persist
CPU resources exhausted on Wazuh Manager
Impact
All API consumers denied service
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Two conditions must both be true: (1) the attacker must hold a valid Wazuh API credential - exploitation is authenticated, PR:L per the CVSS 4.0 vector; and (2) the allow_run_as flag must be explicitly enabled for that account in Wazuh RBAC configuration - this is a non-default, operator-configured permission. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS 4.0 scores this 7.1 with AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H, accurately reflecting that the endpoint is network-reachable, requires only low-privilege credentials (an authenticated account with allow_run_as), and produces high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker holding a Wazuh API account with allow_run_as enabled sends a loop of POST /security/user/authenticate/run_as requests, each with a JSON body containing thousands of levels of nesting such as {"a":{"a":{"a":...}}}. The API framework recursively traverses the full structure on every request with no depth bound, pegging CPU on the Wazuh Manager process. …
Remediation Upgrade Wazuh Manager to version 4.14.7 or later; the CVE description boundary confirms 4.14.7 as the fixed release. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Wazuh Manager instances running versions 4.0.0-4.14.6 or 5.0.0-beta2, document which API users possess the allow_run_as permission, and review API logs for unusual deeply nested JSON submissions to POST /security/user/authenticate/run_as. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Wazuh Manager

View all
CVE-2025-15616 HIGH
7.1 Mar 27

Multiple shell injection and untrusted search path vulnerabilities in Wazuh agent and manager (versions 2.1.0 through 4.
CVE-2026-74044 HIGH
7.0 Aug 18

Path traversal via unsanitized cluster node names in Wazuh Manager 4.0.0 through 4.14.5 enables authenticated cluster pe
CVE-2026-74038 HIGH
7.0 Aug 18

Path traversal in Wazuh Manager 4.0.0 through 4.14.5 allows unauthenticated remote attackers to destroy the manager's qu
CVE-2025-15615 MEDIUM
6.9 Mar 27

Wazuh Manager authd service through version 4.7.3 fails to properly restrict client-initiated SSL/TLS renegotiation requ
CVE-2026-74046 MEDIUM
6.9 Aug 18

Memory exhaustion in Wazuh Manager 4.4.0 through 4.14.6 allows authenticated cluster peers to crash the wazuh-clusterd d

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-41770 HIGH
8.7
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-74039 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy