Executive brief
Wazuh is an open-source security platform used for monitoring and responding to threats across an organization's infrastructure. A flaw in the system's rate-limiting mechanism allows users to bypass global security restrictions when sending event data to the server. This could allow a malicious or compromised account to flood the system with data, potentially overwhelming the analysis engine and hindering the platform's ability to process legitimate security alerts.
Technical details
A logic error exists in the `CheckRateLimitsMiddleware.dispatch()` function within `api/api/middlewares.py`. The middleware first checks the global rate limit (`max_request_per_minute`) and stores the result in an `error_code` variable; however, if the request path is `/events`, it performs a second check against a hardcoded event-specific limit (30/min) and unconditionally overwrites the previous `error_code`. Consequently, if the global limit is exhausted but the event-specific limit is not, the request is incorrectly permitted. An authenticated attacker with `events:ingest` permissions can exploit this to inject events into `analysisd` beyond administrative constraints. The issue is fixed in version 4.14.5 by ensuring the global limit takes precedence.
Affected products
- Wazuh Wazuh Manager >= 4.6.0, < 4.14.5
Timeline
- 2026-03-12: disclosed: Initial researcher discovery and PoC report
- 2026-07-16: advisory: GitHub Security Advisory published
- 2026-07-17: advisory: NVD record published
- 2026-07-16: patched: Fixed in version 4.14.5