CVE-2026-74039: Wazuh DOS Vulnerability via JSON Nesting

CVE-2026-74039 Overview

CVE-2026-74039 is a denial of service vulnerability in Wazuh affecting versions 4.0.0 through 4.14.6 and 5.0.0-beta2. Authenticated attackers with allow_run_as enabled can exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/run_as endpoint. Repeated submission of malformed auth_context bodies with unbounded nesting depth forces the API framework to consume excessive CPU, denying service to other API consumers. The flaw is tracked under [CWE-770] (Allocation of Resources Without Limits or Throttling).

Critical Impact
A single authenticated attacker with run_as privileges can render the Wazuh API unresponsive for all consumers, disrupting security monitoring across managed endpoints.

Affected Products

Wazuh 4.0.0 through 4.14.6
Wazuh 5.0.0-beta2
Deployments with allow_run_as enabled on API user accounts

Discovery Timeline

2026-08-18 - CVE-2026-74039 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-74039

Vulnerability Analysis

The Wazuh API exposes the POST /security/user/authenticate/run_as endpoint to authenticate users under an assumed identity. This endpoint accepts an auth_context JSON body used to evaluate role-mapping rules. The framework parses and traverses this JSON structure without imposing a bound on nesting depth.

An authenticated user whose account has allow_run_as enabled can submit a payload containing thousands of nested objects or arrays. Recursive parsing and evaluation of the structure consume CPU cycles proportional to the depth, and repeated requests amplify the effect. Because the Wazuh API server processes requests through a shared event loop, sustained CPU exhaustion blocks other consumers, including agents and administrators.

Root Cause

The root cause is the absence of input validation on JSON nesting depth in the auth_context handler. The framework accepts and recursively processes arbitrary structures rather than rejecting payloads exceeding a defined depth threshold. This is a classic uncontrolled resource consumption defect classified under [CWE-770].

Attack Vector

Exploitation requires network access to the Wazuh API and valid credentials for a user with allow_run_as set to true. No user interaction is needed. The attacker issues repeated POST requests to /security/user/authenticate/run_as with progressively deeper JSON payloads until the API worker saturates its CPU. The vulnerability affects availability only; confidentiality and integrity are not impacted.

See the VulnCheck Advisory and the GitHub Security Advisory for additional technical context.

Detection Methods for CVE-2026-74039

Indicators of Compromise

Repeated POST requests to /security/user/authenticate/run_as from a single authenticated principal within a short window.
Sustained high CPU utilization on Wazuh API server processes without a corresponding increase in agent traffic.
API response latency increases or timeouts reported by agents and integrations while the manager process remains alive.

Detection Strategies

Enable verbose API access logging and alert on requests to /security/user/authenticate/run_as where the request body exceeds an expected size threshold.
Correlate API request rates per authenticated user against a baseline to flag unusual run_as activity.
Monitor for JSON payloads containing unusually deep bracket nesting at the reverse proxy or WAF layer.

Monitoring Recommendations

Track CPU utilization of the wazuh-apid process and alert on sustained saturation.
Audit which API users have allow_run_as enabled and review whether that privilege is necessary.
Ingest Wazuh API logs into a centralized SIEM to correlate authentication events with resource metrics.

How to Mitigate CVE-2026-74039

Immediate Actions Required

Upgrade Wazuh to version 4.14.7 or later, which addresses the vulnerability.
Disable allow_run_as for any API user that does not require the capability.
Restrict network exposure of the Wazuh API to trusted management networks only.
Rotate credentials for any account with allow_run_as enabled if abuse is suspected.

Patch Information

Wazuh has released a fix in version 4.14.7. The remediation is included in the pull request tracked at GitHub Pull Request #37034. Deployments running 5.0.0-beta2 should move to a fixed release stream once available. Refer to the GitHub Security Advisory GHSA-5vh8-34r8-q74q for authoritative guidance.

Workarounds

Set allow_run_as to false on all API users until the patch can be applied.
Place a reverse proxy in front of the Wazuh API to enforce a maximum request body size and reject oversized payloads.
Apply rate limiting to /security/user/authenticate/run_as at the proxy layer to bound per-user request volume.

bash

# Disable run_as for an API user in api.yaml
# /var/ossec/api/configuration/security/users.yaml
users:
  - username: example_user
    allow_run_as: false

# Restart the API service to apply the change
systemctl restart wazuh-manager