CVE-2026-32983: Wazuh Manager authd Service DoS Flaw

CVE-2026-32983 Overview

CVE-2026-32983 is a Denial of Service vulnerability affecting the Wazuh Manager authd service in wazuh-manager packages through version 4.7.3. The vulnerability stems from an improper restriction of client-initiated SSL/TLS renegotiation, allowing remote attackers to cause service unavailability by sending excessive renegotiation requests. Attackers can exploit the lack of renegotiation limits to consume CPU resources and render the authd service unavailable.

Critical Impact

Remote attackers can exploit this vulnerability to exhaust CPU resources on the Wazuh Manager, disrupting security monitoring and agent authentication services without requiring any authentication.

Affected Products

• Wazuh Manager (wazuh-manager packages) through version 4.7.3
• Wazuh authd service component
• All platforms running vulnerable wazuh-manager versions

Discovery Timeline

• 2026-03-27 - CVE-2026-32983 published to NVD
• 2026-03-31 - Last updated in NVD database

Technical Details for CVE-2026-32983

Vulnerability Analysis

This vulnerability exists within the Wazuh Manager's authd service, which handles agent authentication over SSL/TLS connections. The authd service fails to properly restrict client-initiated SSL/TLS renegotiation requests. SSL/TLS renegotiation allows a client to request a new handshake within an existing secure connection. Without proper limits on these requests, an attacker can repeatedly trigger CPU-intensive cryptographic operations.

The vulnerability is classified under CWE-276, though the attack mechanism specifically abuses the SSL/TLS protocol's renegotiation feature. When exploited, the authd service becomes overwhelmed processing renegotiation handshakes, preventing legitimate Wazuh agents from authenticating and registering with the manager.

Root Cause

The root cause lies in the authd service's SSL/TLS configuration, which does not implement rate limiting or disable client-initiated renegotiation. Modern TLS implementations typically allow configuration options to disable renegotiation or limit the frequency of such requests. The Wazuh authd service in affected versions does not enforce these controls, leaving the service vulnerable to resource exhaustion attacks.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker establishes a legitimate SSL/TLS connection to the authd service (typically on port 1515) and then floods the connection with renegotiation requests. Each renegotiation request triggers a full cryptographic handshake, consuming significant CPU resources.

The attack can be executed from any network location that can reach the Wazuh Manager's authd service, making internet-exposed deployments particularly at risk. The vulnerability allows for sustained denial of service with relatively low attacker resources, as the asymmetric nature of SSL/TLS renegotiation means the server performs more work than the client.

Detection Methods for CVE-2026-32983

Indicators of Compromise

• Abnormally high CPU utilization on the Wazuh Manager host, particularly associated with the wazuh-authd process
• Excessive SSL/TLS handshake activity in network traffic to port 1515
• Agent registration failures or authentication timeouts reported by Wazuh agents
• Log entries indicating connection handling issues in the authd service logs

Detection Strategies

• Monitor CPU usage patterns on Wazuh Manager systems for sustained spikes correlating with authd service activity
• Implement network intrusion detection rules to identify excessive TLS renegotiation requests from single sources
• Configure alerting for Wazuh agent authentication failures that could indicate service unavailability
• Deploy connection rate monitoring for the authd service port to detect anomalous connection patterns

Monitoring Recommendations

• Enable detailed logging for the Wazuh authd service to capture connection and handshake events
• Implement infrastructure monitoring to track service availability and response times for the authd endpoint
• Configure alerts for unexpected restarts or crashes of the wazuh-authd process
• Monitor network traffic metadata for connections exhibiting repeated renegotiation patterns

How to Mitigate CVE-2026-32983

Immediate Actions Required

• Review your Wazuh Manager deployment version and identify if running version 4.7.3 or earlier
• Implement network-level rate limiting for connections to the authd service port (1515)
• Restrict network access to the authd service to trusted agent IP ranges using firewall rules
• Consider placing the authd service behind a reverse proxy or load balancer with TLS renegotiation protections

Patch Information

Organizations running affected versions should consult the official Wazuh security advisories for patch availability. Additional details regarding this vulnerability can be found in the GitHub Security Advisory and the VulnCheck Advisory. Monitor the Wazuh project for updates addressing this SSL/TLS renegotiation issue.

Workarounds

• Deploy firewall rules to restrict authd service access to known agent IP addresses only
• Implement connection rate limiting at the network layer to throttle excessive connection attempts
• If possible, configure a TLS-terminating proxy in front of authd that enforces renegotiation limits
• Monitor for and block IP addresses exhibiting attack patterns against the service

# Example firewall rule to restrict authd access (iptables)
# Replace 10.0.0.0/8 with your trusted agent network range
iptables -A INPUT -p tcp --dport 1515 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 1515 -j DROP

# Example connection rate limiting (iptables)
iptables -A INPUT -p tcp --dport 1515 -m connlimit --connlimit-above 10 -j REJECT