CVE-2026-33434 Overview
CVE-2026-33434 is a rate limiting flaw in Wazuh, an open source platform for threat prevention, detection, and response. The vulnerability affects versions 4.6.0 through 4.14.4 and stems from a logic error in the CheckRateLimitsMiddleware.dispatch() function. The /events endpoint rate check unconditionally overwrites the general rate limit result. When the global max_request_per_minute threshold is exceeded, requests to /events still succeed if the hardcoded events-specific counter of 30 per minute has not been reached. This allows authenticated attackers to inject events into analysisd beyond the administrator-configured global rate limit. Wazuh addressed the issue in version 4.14.5.
Critical Impact
Authenticated attackers can bypass the global request rate limit and flood the Wazuh analysisd component with events, degrading detection integrity and consuming resources.
Affected Products
- Wazuh 4.6.0 through 4.14.4
- Wazuh server components exposing the /events API endpoint
- Deployments relying on max_request_per_minute for API rate control
Discovery Timeline
- 2026-07-17 - CVE-2026-33434 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-33434
Vulnerability Analysis
The vulnerability is a business logic flaw classified as improper enforcement of resource limits [CWE-799]. Wazuh's API uses CheckRateLimitsMiddleware to enforce request throttling based on the administrator-defined max_request_per_minute setting. The middleware performs two checks: a global rate check applied to all endpoints, and a stricter events-specific check hardcoded at 30 requests per minute for /events.
The dispatch() method evaluates the global rate limit first, then evaluates the events-specific limit. The implementation error causes the events check to unconditionally overwrite the global check result. When the global counter reports a violation, the events check still returns success if fewer than 30 event requests have been observed in the current window, silently discarding the earlier violation.
Exploitation requires only low-privileged authenticated access to the API. An attacker submits events to /events at up to 30 requests per minute per client, regardless of how saturated the global budget is. Injected events reach analysisd, which processes alerts and correlates rules. Sustained abuse can flood detection pipelines, generate misleading alerts, or mask malicious activity within noise.
Root Cause
The root cause is control flow in CheckRateLimitsMiddleware.dispatch() that overwrites rather than combines the results of the two rate limit checks. The events-specific check should be additive to the global check, but the implementation treats it as authoritative, effectively creating a bypass path for the /events endpoint.
Attack Vector
The attack vector is network-based and requires low-privileged API credentials. An authenticated client repeatedly issues POST requests to the /events endpoint at a sustained rate below 30 per minute. Because the middleware overwrites the global result, requests succeed even when the administrator's global limit has been exhausted by other traffic. The technical description of the flaw is documented in the Wazuh GitHub Security Advisory GHSA-37qc-8242-6crg.
Detection Methods for CVE-2026-33434
Indicators of Compromise
- Sustained sequences of POST requests to the /events API endpoint from a single authenticated identity at rates approaching 30 per minute.
- API access logs showing continued /events traffic after other endpoints from the same client have been throttled by max_request_per_minute.
- Unusual spikes in event ingestion volume within analysisd that do not correlate with agent activity or infrastructure changes.
Detection Strategies
- Compare per-client request counts against the configured max_request_per_minute value and alert when /events traffic exceeds proportional expectations.
- Baseline normal /events ingestion volume per API user and flag deviations that align with the 30 requests-per-minute ceiling.
- Correlate API authentication logs with analysisd event volume to identify a single credential driving abnormal ingestion.
Monitoring Recommendations
- Enable verbose logging on the Wazuh API and forward logs to a centralized analytics platform for rate-anomaly analysis.
- Monitor the health and queue depth of analysisd for sustained backlog conditions indicative of event flooding.
- Track the running Wazuh server version across all managers and alert on any node below 4.14.5.
How to Mitigate CVE-2026-33434
Immediate Actions Required
- Upgrade all Wazuh manager instances to version 4.14.5 or later, which contains the corrected middleware logic.
- Audit API user accounts and rotate credentials for any low-privileged accounts exposed to untrusted networks.
- Restrict network access to the Wazuh API using firewall rules or reverse proxy allowlists to limit which clients can reach /events.
Patch Information
Wazuh fixed CVE-2026-33434 in version 4.14.5. The patch corrects CheckRateLimitsMiddleware.dispatch() so that the events-specific check no longer overwrites the global rate limit result. Details are available in the Wazuh GitHub Security Advisory GHSA-37qc-8242-6crg.
Workarounds
- Place a reverse proxy such as NGINX or HAProxy in front of the Wazuh API and enforce request rate limits on /events externally until patching is complete.
- Reduce the scope of API roles so that only trusted agents and integrations can reach the /events endpoint.
- Monitor analysisd ingestion rates and manually revoke tokens observed exceeding expected event volumes.
# Upgrade Wazuh manager to the fixed release on Debian/Ubuntu
sudo apt-get update
sudo apt-get install wazuh-manager=4.14.5-1
sudo systemctl restart wazuh-manager
# Verify the running version
/var/ossec/bin/wazuh-control info | grep WAZUH_VERSION
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
