CVE-2026-74030 in wazuh-agent
Summary
by MITRE • 10/13/2026
Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memory. Attackers controlling the manager can push a small SCA policy with nested aliases via merged.mg to OOM-kill wazuh-modulesd on every agent in a group.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified vulnerability resides within the Wazuh platform, specifically affecting versions ranging from 3.9.0 up to but not including version 4.14.8. This security flaw is classified as an uncontrolled YAML alias expansion issue located within the yaml2json_node component of the software architecture. The core technical deficiency stems from how the system processes YAML documents that contain nested aliases during their conversion into JSON format for internal processing or transmission to agents. In standard YAML parsing, aliases are used to reference other nodes in a document tree, allowing for concise representation of repeated data structures. However, when an attacker can control the content being parsed through this specific node function without adequate depth limits or recursion checks, it becomes possible to construct maliciously crafted YAML payloads that trigger excessive memory allocation during expansion.
The operational impact of this vulnerability is severe due to its potential for causing a Denial of Service condition via Out-of-Memory errors. An attacker who has gained control over the Wazuh manager can exploit this flaw by pushing a specially constructed Security Configuration Assessment policy file, specifically targeting the merged.mg configuration mechanism. By embedding deeply nested YAML aliases within this policy, the agent's wazuh-modulesd process is forced to expand these references recursively and exhaustively. This uncontrolled expansion rapidly consumes available system memory on the affected endpoint. As the memory usage spikes beyond the limits allocated to the module daemon, the operating system’s kernel intervenes by terminating the process through an Out-of-Memory kill signal. Consequently, this results in a service disruption for all agents within the targeted group, effectively halting their security monitoring and data collection capabilities until the service is manually restarted or the malicious policy is removed.
From a threat modeling perspective, this vulnerability aligns with Common Weakness Enumeration standard CWE-770, which describes allocation of resources without limits or thresholds. The attack vector leverages the trust relationship between the manager and agents, requiring an attacker to have administrative control over the Wazuh manager infrastructure rather than direct access to individual endpoints. This scenario is consistent with ATT&CK technique T1496, Resource Hijacking, where compromised systems are used for unintended purposes such as resource exhaustion, although in this specific case, the primary outcome is denial of service rather than cryptomining or other compute-intensive activities. The exploitation relies on the ability to inject malicious configuration data into a trusted channel, highlighting risks associated with insufficient input validation and sanitization in configuration management workflows.
To mitigate this vulnerability, organizations running Wazuh versions prior to 4.14.8 must upgrade their infrastructure immediately to version 4.14.8 or later, where the yaml2json_node function has been patched to enforce strict limits on alias expansion depth and memory usage during YAML processing. Until an upgrade is feasible, administrators should rigorously audit all SCA policies pushed from the manager to agents, ensuring that no nested aliases are present in configuration files destined for agent consumption. Additionally, implementing network-level segmentation or access controls can restrict which entities have write privileges to the merged.mg policy distribution channel, thereby reducing the attack surface available to potential adversaries who might compromise the central management server. Regular monitoring of agent memory usage and process stability should also be enhanced to detect anomalies indicative of such resource exhaustion attacks in real time.