CVE-2026-74030: Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion
Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2jsonnode that allows a manager-controlled policy to exhaust agent memory. Attackers controlling the manager can push a small SCA policy with nested aliases via merged.mg to OOM-kill wazuh-modulesd on every agent in a group.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Wazuh deployments running versions from 3.9.0 through versions before 4.14.8 are affected. The impact is on agents that receive the malicious SCA policy from a manager.
What access does an attacker need to exploit it?
The attacker must be able to control the Wazuh manager and push a crafted SCA policy to an agent group. The policy uses nested YAML aliases through merged.mg to consume agent memory.
What is the operational impact on affected agents?
A small malicious policy can exhaust memory and cause the operating system to OOM-kill wazuh-modulesd. This can occur on every agent in the targeted group.
How can I determine whether an agent may already be affected?
Check whether affected agents run a Wazuh version earlier than 4.14.8 and receive SCA policies from the manager. On impacted systems, investigate whether wazuh-modulesd has been terminated by the operating system due to out-of-memory conditions.