Executive brief
Wazuh is a popular open-source security monitoring and threat detection platform used to centralize log data and monitor system activity. An authenticated attacker with the `allow_run_as` privilege can submit specially crafted JSON requests to exhaust CPU resources in the API's authentication service, making the system unavailable to legitimate operators. This could disrupt security monitoring and incident response during a critical investigation or security event.
Technical details
This is a denial-of-service vulnerability in the Wazuh API's authentication endpoint (POST /security/user/authenticate/run_as) that stems from uncontrolled recursion and regex matching on user-supplied JSON payloads. The RBAChecker.find_item function recursively walks the auth_context JSON structure without depth limits, and applies role-defined regular expressions via re.match() with no execution timeout. The root cause is compounded by the API framework using a ThreadPoolExecutor with only a single worker thread for all authentication operations—when this thread is saturated by a slow regex evaluation, all concurrent login attempts and token validations block. An attacker with allow_run_as=True privileges can submit payloads of up to ~4.7 MB with deep nesting (4+ levels), causing the authentication pool to stall for 1–2 seconds per request; six concurrent malicious requests degrade legitimate login latency by 7–8x. Patches are available in version 4.14.7 and later, implementing payload size limits, recursion depth checks, and regex timeouts.
Affected products
- Wazuh Wazuh Manager 4.0.0 before 4.14.7 and 5.0.0-beta2
Timeline
- 2026-08-18: disclosed
- 2026-07-07: patched: Fix merged into 4.14.7 branch on July 7, 2026