CVE-2026-74039: wazuh

Vulnerability summary

CVE-2026-74039 is a high (CVSS 7.1) vulnerability in wazuh. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 18-08-2026
   PublishedVulnerability first disclosed.
2. 01-10-2026
   Last modifiedVulnerability information updated.

Description

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow_run_as enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/run_as endpoint. Attackers can repeatedly submit malformed auth_context bodies with unlimited nesting depth to cause the API framework to consume excessive CPU, denying service to all other API consumers.

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
• CWE-1333Inefficient Regular Expression ComplexityThe product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.