CVE-2026-33434: Wazuh: Rate Limit Bypass via /events Endpoint
Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.6.0 and above, prior to 4.14.5, a logic error in CheckRateLimitsMiddleware.dispatch() causes the /events endpoint rate check to unconditionally overwrite the general rate limit result. When the global maxrequestperminute is exceeded, requests to /events still succeed if the events-specific counter (hardcoded 30/min) has not been reached. This allows event injection into analysisd beyond the admin-configured global rate limit. This issue has been fixed in version 4.14.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 4.14.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33434?
CVE-2026-33434 has a medium severity rating of 4.3.
How do I fix CVE-2026-33434?
To fix CVE-2026-33434, upgrade Wazuh to version 4.14.5 or later.
What software is affected by CVE-2026-33434?
CVE-2026-33434 affects Wazuh versions 4.6.0 to 4.14.4.
What does CVE-2026-33434 exploit?
CVE-2026-33434 exploits a logic error in CheckRateLimitsMiddleware.dispatch() affecting the /events endpoint.
What potential impact does CVE-2026-33434 have?
CVE-2026-33434 can allow attackers to bypass rate limiting on the /events endpoint, potentially leading to abuse.