Vulnerability · Published Aug 18, 2026 · Assigned by VulnCheck

CVE-2026-74039Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context

Medium 6.5

In plain English

A medium-severity resource allocation without limits in wazuh-manager from Wazuh. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.6%top 53.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow_run_as enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/run_as endpoint. Attackers can repeatedly submit malformed auth_context bodies with unlimited nesting depth to cause the API framework to consume excessive CPU, denying service to all other API consumers.

Affected products (as reported)

Vendor	Product	Versions
Wazuh	wazuh-manager	4.0.0 – before 4.14.75.0.0-beta2

Weakness: CWE-770, CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-5vh8-34r8-q74q) vendor-advisory
Pull Request patch
https://www.vulncheck.com/advisories/wazuh-api-dos-via-deeply-nested-json-auth-context third-party-advisory