Description

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow_run_as enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/run_as endpoint. Attackers can repeatedly submit malformed auth_context bodies with unlimited nesting depth to cause the API framework to consume excessive CPU, denying service to all other API consumers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T18:19:33.760Z",
  "pubdate": "2026-08-18T18:19:33.760Z",
  "executiveSummary": "Wazuh versions 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability affecting the API framework. The flaw is classified as a denial of service vulnerability caused by uncontrolled resource consumption. The impact of successful exploitation is a complete denial of service, rendering the Wazuh API unavailable to all other legitimate API consumers due to CPU resource exhaustion. The affected product is Wazuh, specifically impacting the API authentication mechanism. The risk implications are severe for operational availability, as critical security monitoring and management operations rely on the API framework. The attacker capabilities required include authentication credentials and the specific precondition that the allow_run_as configuration parameter is enabled on the target system. Exploitation requires the attacker to interact with a specific API endpoint using maliciously crafted payloads. No CVE identifier is provided in the input, but the vulnerability represents a significant availability risk to deployments operating with default or permissive configurations where run-as privileges are permitted.",
  "technicalDetails": "The vulnerability resides within the Wazuh API framework, specifically targeting the POST /security/user/authenticate/run_as endpoint and its handling of the auth_context request body. The root cause of the vulnerability is the lack of input validation or depth limitation when parsing JSON structures submitted to the API endpoint. When the allow_run_as setting is enabled, the API framework attempts to parse incoming JSON payloads containing auth_context bodies. Because the application fails to restrict or validate the nesting depth of these JSON structures, an authenticated attacker can submit arbitrarily deeply nested JSON objects. When the parser processes these excessively nested structures, it triggers recursive evaluation or heavy computational overhead, leading to CPU resource exhaustion. The attack flow begins with an authenticated attacker establishing communication with the target Wazuh API over the network. The attacker crafts a malicious HTTP POST request destined for the /security/user/authenticate/run_as endpoint. Within the request body, the attacker inserts a heavily nested JSON structure inside the auth_context parameter. The attacker then repeatedly submits these malformed payloads to continuously saturate the processing threads of the API framework. The vulnerable component is the JSON parsing and deserialization logic associated with the run-as authentication handler. The affected versions include Wazuh 4.0.0 through 4.14.6 and version 5.0.0-beta2. The exploitation requirements dictate that the attacker must be authenticated to the API and that the allow_run_as feature must be explicitly enabled. Network exposure is present wherever the Wazuh API is reachable by authenticated users. The payload behavior forces the underlying CPU to spend excessive cycles traversing and evaluating the deep object hierarchies. Consequently, post-exploitation impact manifests as severe CPU starvation, causing the API service to become unresponsive or crash, thereby denying access to all concurrent API consumers and disrupting enterprise security operations."
}