CVE-2026-74039: Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context
Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allowrunas enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/runas endpoint. Attackers can repeatedly submit malformed authcontext bodies with unlimited nesting depth to cause the API framework to consume excessive CPU, denying service to all other API consumers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 4.14.7
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects Wazuh 4.0.0 through versions before 4.14.7, as well as Wazuh 5.0.0-beta2. An exposed API must also have allow_run_as enabled.
What does an attacker need to exploit this?
An attacker needs authenticated access and permissions sufficient to use the run_as authentication functionality when allow_run_as is enabled. No user interaction is required.
What can be done if patching is not immediately possible?
The provided information identifies version 4.14.7 as the fixed boundary for the 4.x release line. For systems that cannot be updated immediately, disabling allow_run_as prevents use of the vulnerable run_as endpoint condition described.
How can defenders identify possible exploitation?
Look for repeated requests to POST /security/user/authenticate/run_as containing malformed auth_context JSON with unusually deep nesting, along with sustained or excessive API CPU usage and service disruption for API consumers.