CVE-2026-74039: Wazuh API denial of service via deeply nested JSON

CVE-2026-74039 · Severity: medium · CVSS 6.5 · Published 2026-08-18

Wazuh is a popular open-source security monitoring and threat detection platform used to centralize log data and monitor system activity. An authenticated attacker with the `allow_run_as` privilege can submit specially crafted JSON requests to exhaust CPU resources in the API's authentication service, making the system unavailable to legitimate operators. This could disrupt security monitoring and incident response during a critical investigation or security event.

Technologies: Wazuh Manager. Vendors: Wazuh.

Quick answers

Is CVE-2026-74039 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-74039 being exploited in the wild.
How severe is CVE-2026-74039?
Medium severity, with a CVSS score of 6.5, published 18 August 2026.
Which products and versions are affected?
Wazuh Manager 4.0.0 before 4.14.7 and 5.0.0-beta2.
Is there a fix for CVE-2026-74039?
A patch was published on 2026-07-07: Fix merged into 4.14.7 branch on July 7, 2026 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-74039 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-74039?
Check whether you run Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a denial-of-service vulnerability in the Wazuh API's authentication endpoint (POST /security/user/authenticate/run_as) that stems from uncontrolled recursion and regex matching on user-supplied JSON payloads. The RBAChecker.find_item function recursively walks the auth_context JSON structure without depth limits, and applies role-defined regular expressions via re.match() with no execution timeout. The root cause is compounded by the API framework using a ThreadPoolExecutor with only a single worker thread for all authentication operations—when this thread is saturated by a slow regex evaluation, all concurrent login attempts and token validations block. An attacker with allow_run_as=True privileges can submit payloads of up to ~4.7 MB with deep nesting (4+ levels), causing the authentication pool to stall for 1–2 seconds per request; six concurrent malicious requests degrade legitimate login latency by 7–8x. Patches are available in version 4.14.7 and later, implementing payload size limits, recursion depth checks, and regex timeouts.

Affected products

  • Wazuh Wazuh Manager 4.0.0 before 4.14.7 and 5.0.0-beta2

Timeline

  • 2026-08-18: disclosed
  • 2026-07-07: patched: Fix merged into 4.14.7 branch on July 7, 2026

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.