CVE-2026-74039 Wazuh CVE debrief

Who should care

Defenders and security teams responsible for Wazuh API configurations and deployments should assess exposure and implement mitigations to prevent potential DoS attacks. This includes verifying Wazuh API configurations, assessing allow_run_as settings, and implementing compensating controls. Security teams should also monitor API consumer logs for excessive CPU consumption and adjust resource allocation as needed.

Why it matters

CVE-2026-74039 is a high-severity vulnerability affecting Wazuh API deployments. Defenders should verify exposure, assess configurations, and implement compensating controls to mitigate potential DoS attacks. Evidence is limited, and specific remediation steps require verification from official sources.

• Potential denial of service to other API consumers due to excessive CPU consumption
• Need for verification of Wazuh API configurations and allow_run_as settings
• Possible impact on system performance and resource allocation
• Requirement for input validation and rate limiting on the affected endpoint

Technical summary

The vulnerability allows authenticated attackers with allow_run_as enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/run_as endpoint, affecting Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2. This denial-of-service vulnerability impacts system performance, and defenders should prioritize verifying exposure, assessing Wazuh API configurations, and implementing compensating controls to mitigate potential DoS attacks. The vulnerability has a CVSS score of 7.1, indicating high severity.

Defensive priority

Defenders should prioritize verifying exposure, assessing Wazuh API configurations, and implementing compensating controls to mitigate potential DoS attacks.

Recommended defensive actions

• Verify Wazuh API configurations and ensure allow_run_as is disabled or restricted to necessary users
• Implement rate limiting and input validation for the POST /security/user/authenticate/run_as endpoint
• Monitor API consumer logs for excessive CPU consumption and adjust resource allocation as needed
• Consider applying vendor-provided patches or updates when available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.1 and affected versions. However, specific remediation steps and exploit details are limited. Evidence is based on official CVE Program and NVD sources, with limited additional context. Defenders should verify Wazuh API configurations and allow_run_as settings for potential exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.