---
cve: "CVE-2026-26206"
severity: "MEDIUM"
cvss: 6.5
epss: "0.2%"
vendor: "wazuh"
kev: false
exploited: false
published: "2026-04-29 19:16:22"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T20:49:25+01:00"
---

# CVE-2026-26206

> 6.5 MEDIUM · 🧪 PoC

## Beschreibung

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, Wazuh's server API brute-force protection for POST /security/user/authenticate can be bypassed by sending concurrent authentication requests. Although the configured threshold (max_login_attempts, default 50) is enforced correctly for sequential requests, a parallel burst allows significantly more failed login attempts to be processed before the IP block is applied. This enables an attacker to perform more password guesses than the configured policy intends (e.g., 100 attempts processed where 50 should be allowed). This issue has been patched in version 4.14.4.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2026-04-29 18:51:59
- CNA-CVSS: **6.5** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Gering | warn |
| I Integrität | Gering | warn |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-307** — Improper Restriction of Excessive Authentication Attempts
  The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
- **CWE-362** — Concurrent Execution using Shared Resource with Improper Synchronization
  The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
- **CWE-367** — Time-of-check Time-of-use (TOCTOU) Race Condition
  The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

## Angriffsmuster (CAPEC)

- [CAPEC-16 — Dictionary-based Password Attack](https://capec.mitre.org/data/definitions/16.html) _(Severity: High)_
- [CAPEC-49 — Password Brute Forcing](https://capec.mitre.org/data/definitions/49.html) _(Severity: High)_
- [CAPEC-560 — Use of Known Domain Credentials](https://capec.mitre.org/data/definitions/560.html) _(Severity: High)_
- [CAPEC-565 — Password Spraying](https://capec.mitre.org/data/definitions/565.html) _(Severity: High)_
- [CAPEC-600 — Credential Stuffing](https://capec.mitre.org/data/definitions/600.html) _(Severity: High)_
- [CAPEC-652 — Use of Known Kerberos Credentials](https://capec.mitre.org/data/definitions/652.html) _(Severity: High)_
- [CAPEC-653 — Use of Known Operating System Credentials](https://capec.mitre.org/data/definitions/653.html) _(Severity: High)_

## ATT&CK-Techniken

- [T1110.001 — Brute Force:Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
- [T1078 — Valid Accounts](https://attack.mitre.org/techniques/T1078/)
- [T1110.003 — Brute Force:Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
- [T1110.004 — Brute Force:Credential Stuffing](https://attack.mitre.org/techniques/T1110/004/)
- [T1558 — Steal or Forge Kerberos Tickets](https://attack.mitre.org/techniques/T1558/)

## Patch verfügbar (OSV)

- 5933ec9ebee76fb2546e5f7fc9f3a27d0aeca605 (Commit)

## BSI-Hinweise (deutsch)

- [Wazuh: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-1295) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in Wazuh ausnutzen, um einen Denial of Service Angriff durchzuführen, beliebigen Code auszuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder Sicherheitsmaßnahmen zu umgehen.

## Referenzen

- <https://github.com/wazuh/wazuh/security/advisories/GHSA-m2mr-xhhv-jx58>
- <https://github.com/wazuh/wazuh/releases/tag/v4.14.4>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-26206/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_