CVE-2026-74039

Medium

Description

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow_run_as enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/run_as endpoint. Attackers can repeatedly submit malformed auth_context bodies with unlimited nesting depth to cause the API framework to consume excessive CPU, denying service to all other API consumers.

SeverityMedium

CVSS6.5

Exploit probability—

ProductWazuh

PublishedAug 18, 2026

First seenAug 18, 2026

Weakness typeCWE-770Allocation of resources without limits CWE-1333CWE-1333

How to fix

Update

wazuh wazuh4.14.7 or later

Patches

github.com/wazuh/wazuh/pull/37034

Vendor advisories

github.com/wazuh/wazuh/security/advisories/GHSA-5vh8-34r8-q74q

Affected products

Product	Affected versions	Fixed in
wazuh wazuh	4.0.0 ≤ v < 4.14.7, 5.0.0	4.14.7

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.