EUVD-2026-98668Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain control of Wazuh manager
-
ExploitCraft SCA policy with nested YAML aliases
-
ExecutionPush policy via merged.mg to agent group
-
ImpactOOM-kill wazuh-modulesd on every agent
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration XML entity recursion limits
|
| Exploitation Conditions | The attacker must already control the Wazuh manager and be able to push a crafted SCA policy containing deeply nested YAML aliases, which is then distributed to agents via the merged.mg group-configuration channel; the yaml2json_node parser on the agent side performs uncontrolled alias expansion. Affected versions are Wazuh 3.9.0 through 4.14.7 (agent and manager). Limiting factors: exploitation is gated on manager control (PR:H), a high-trust role in Wazuh's architecture, and the impact is restricted to availability - specifically OOM-killing wazuh-modulesd on agents in the targeted group, with no confidentiality or integrity effect. |
| Impact | This is a medium-severity availability-only flaw (CVSS 4.0 base 6.9, vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H). The decisive signal is PR:H: exploitation requires the attacker to already control the Wazuh manager, which in Wazuh's trust model is a highly privileged position that legitimately pushes policies to agents. Given that, the network vector and low complexity (AV:N/AC:L) do not translate into easy opportunistic attacks - this is a post-compromise or malicious/compromised-manager scenario, effectively a privilege-to-impact amplification (one manager can OOM-kill wazuh-modulesd across an entire agent group). No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit was referenced, so there is no evidence of active exploitation. The impact is confined to availability (VC:N/VI:N/VA:H) - there is no confidentiality or integrity loss, which directly contradicts the 'Information Disclosure' tag in the input metadata. Net assessment: a legitimate bug worth patching (a classic CWE-776 billion-laughs-style resource exhaustion) but NOT a high-urgency, internet-facing emergency; prioritize it as a resilience/defense-in-depth fix for the monitoring tier rather than a critical remote threat. |
| Exploit ScenarioDerived | An attacker who has gained control of a Wazuh manager (or an insider operating it) crafts a small SCA policy file containing deeply nested YAML aliases and distributes it through the merged.mg channel to a group of agents. When each agent's yaml2json_node parses the policy, uncontrolled alias expansion explodes memory consumption and the OS OOM-killer terminates wazuh-modulesd, disabling security monitoring across every agent in that group. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Memory exhaustion in Wazuh agents (versions 3.9.0 through 4.14.7) allows an attacker who already controls the Wazuh manager to OOM-kill wazuh-modulesd on every agent in a targeted group by pushing a small SCA policy containing deeply nested YAML aliases through the merged.mg group-configuration channel. The agent-side yaml2json_node parser performs uncontrolled alias expansion, so the tiny policy expands into a far larger in-memory structure and consumes the agent process's memory. Exploitation is gated on manager control (CVSS 4.0 base 6.9, AV:N/AC:L/PR:H/UI:N/VC:N/VI:N/VA:H) and the impact is availability-only - no confidentiality or integrity effect; no public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available in Wazuh 4.14.8.
RemediationAI
Upgrade both manager and agents to Wazuh 4.14.8 or later - the vendor-released patch version is 4.14.8, documented in the advisory at https://github.com/wazuh/wazuh/security/advisories/GHSA-x8v7-g49q-ff7j and available from https://github.com/wazuh/wazuh/releases/tag/v4.14.8; because policy content flows from manager to agent, patching agents is what actually removes the vulnerable parser, but upgrading the manager as well keeps the fleet consistent. Until agents can be upgraded, treat 'who can write into /var/ossec/etc/shared/*' as a security boundary: restrict manager filesystem and API access to trusted administrators, tighten Wazuh RBAC roles so that only a minimal set of accounts can edit group configuration or push SCA policies, and enable file-integrity monitoring on the shared configuration directory so an unexpected policy edit is detected before the next merged.mg distribution. As a containment measure, run wazuh-modulesd under a cgroup or systemd unit with an explicit MemoryMax/MemoryHigh limit so alias expansion is stopped at a bounded size - the trade-off is that wazuh-modulesd will still be terminated once the cap is reached, but the agent's other daemons and the host itself will not be dragged into the OOM event. Alert on repeated wazuh-modulesd restarts or OOM-killer messages across many agents in the same group, which is the characteristic signature of this attack, and review recent group-level SCA policy changes for unusually small YAML files containing deeply nested anchors and aliases. There is no vendor-released configuration switch that disables YAML alias expansion in yaml2json_node, so parser-level mitigation is only available through the 4.14.8 upgrade.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a YAML alias-expansion denial of service (CWE-776, the recursive-entity/'billion laughs' class, here applied to YAML rather than XML DTDs) in the yaml2json_node component that Wazuh uses to convert SCA policy YAML into JSON. YAML anchors and aliases let a document reference a previously defined node, and a chain of nested aliases expands exponentially: a policy only a few kilobytes in size can resolve into gigabytes of materialized data. Because SCA policies are authored on the manager and distributed to agents via the shared group configuration bundled into merged.mg, the expansion happens inside wazuh-modulesd on each agent, which is killed by the kernel OOM killer - and every agent in the affected group is hit simultaneously, making this a fleet-wide availability issue driven from a single high-trust control point. The CPE data confirms both the agent and manager are in scope (cpe:2.3:a:wazuh:wazuh-agent and cpe:2.3:a:wazuh:wazuh-manager). Note that the supplied 'Information Disclosure' tag is not consistent with the assessed availability-only impact and appears to be a classification mismatch. The CVSS 4.0 vector records PR:H, consistent with the requirement that the attacker already hold manager-level control, and the Wazuh 4.14.8 release notes include related SCA policy source validation hardening (PR #37953) alongside a set of other manager fixes.
Know when Wazuh Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Exploitation requires control of the Wazuh manager that distributes policies, so PR:H; low complexity and network-delivered, with impact limited to availability (A:H), no confidentiality or integrity effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memory. Attackers controlling the manager can push a small SCA policy with nested aliases via merged.mg to OOM-kill wazuh-modulesd on every agent in a group.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Wazuh Manager
View allArbitrary file overwrite in Wazuh Manager (3.9.0 through versions prior to 4.14.8) lets an attacker who already controls
Root-level command execution on the Wazuh Manager host is achievable by an authenticated administrator who holds the man
Arbitrary file read as root in Wazuh Manager 4.1.0 through 4.14.7 allows an enrolled agent to inject an upgrade_custom m
Wazuh Manager 4.0.0 through 4.14.7 fails to consult its token revocation blacklist inside the check_token routine, so a
An authentication bypass in the Wazuh Manager API (versions 4.6.0 through 4.14.7) lets an account that already holds del
Path traversal in the Wazuh Manager cluster upload handlers (upload_list_file, upload_rule_file, upload_decoder_file) le
Path traversal in Wazuh Manager 4.1.1 through 4.14.7 lets an attacker who has already compromised a cluster worker node
Heap buffer overflow in Wazuh Manager's File Integrity Monitoring alert generation lets an enrolled agent corrupt manage
CPU exhaustion in Wazuh Manager 4.0.0-4.14.6 and 5.0.0-beta2 allows authenticated API users with the allow_run_as permis
Wazuh Manager 4.0.0 through 4.14.7 exposes the plaintext authd.pass agent-enrollment password to authenticated low-privi
Multiple shell injection and untrusted search path vulnerabilities in Wazuh agent and manager (versions 2.1.0 through 4.
Path traversal in Wazuh Manager's delete_rule_file and delete_decoder_file helpers lets an attacker who holds the Wazuh
Exploit-DB