CVE-2026-26206

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, Wazuh's server API brute-force protection for POST /security/user/authenticate can be bypassed by sending concurrent authentication requests. Although the configured threshold (max_login_attempts, default 50) is enforced correctly for sequential requests, a parallel burst allows significantly more failed login attempts to be processed before the IP block is applied. This enables an attacker to perform more password guesses than the configured policy intends (e.g., 100 attempts processed where 50 should be allowed). This issue has been patched in version 4.14.4.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/wazuh/wazuh/releases/tag/v4.14.4	Release Notes
https://github.com/wazuh/wazuh/security/advisories/GHSA-m2mr-xhhv-jx58	Exploit Vendor Advisory
https://github.com/wazuh/wazuh/security/advisories/GHSA-m2mr-xhhv-jx58	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*

History

30 Apr 2026, 20:38

Type	Values Removed	Values Added
CPE		cpe:2.3:a:wazuh:wazuh::::::::
First Time		Wazuh wazuh Wazuh
References	~~() https://github.com/wazuh/wazuh/releases/tag/v4.14.4 -~~	() https://github.com/wazuh/wazuh/releases/tag/v4.14.4 - Release Notes
References	~~() https://github.com/wazuh/wazuh/security/advisories/GHSA-m2mr-xhhv-jx58 -~~	() https://github.com/wazuh/wazuh/security/advisories/GHSA-m2mr-xhhv-jx58 - Exploit, Vendor Advisory

30 Apr 2026, 15:11

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-29 19:16

Updated : 2026-04-30 20:38

NVD link : CVE-2026-26206

Mitre link : CVE-2026-26206

CVE.ORG link : CVE-2026-26206

JSON object : View

Products Affected

wazuh

wazuh

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

{"id": "CVE-2026-26206", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2026-04-29T19:16:22.600", "references": [{"url": "https://github.com/wazuh/wazuh/releases/tag/v4.14.4", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-m2mr-xhhv-jx58", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-m2mr-xhhv-jx58", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-307"}, {"lang": "en", "value": "CWE-362"}, {"lang": "en", "value": "CWE-367"}]}], "descriptions": [{"lang": "en", "value": "Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, Wazuh's server API brute-force protection for POST /security/user/authenticate can be bypassed by sending concurrent authentication requests. Although the configured threshold (max_login_attempts, default 50) is enforced correctly for sequential requests, a parallel burst allows significantly more failed login attempts to be processed before the IP block is applied. This enables an attacker to perform more password guesses than the configured policy intends (e.g., 100 attempts processed where 50 should be allowed). This issue has been patched in version 4.14.4."}], "lastModified": "2026-04-30T20:38:48.230", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8147D947-167A-4F70-A689-81B33A161A83", "versionEndExcluding": "4.14.4", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}