CVE-2026-93346

Executive Summary

CVE-2026-93346 is a race condition vulnerability in the Wazuh SIEM/XDR platform's API login throttling mechanism affecting versions 4.0.0 through 4.14.7. Unauthenticated remote attackers can bypass the max_login_attempts protection by sending concurrent authentication requests to the authenticate and run_as API endpoints, effectively circumventing account lockout controls. Successful exploitation enables unlimited password guessing against Wazuh API accounts, potentially leading to unauthorized access to the security monitoring infrastructure and the sensitive telemetry it manages.

Technical Analysis

The vulnerability resides in the API authentication throttling subsystem of Wazuh. Wazuh's API implements a login attempt counter designed to block accounts after a configurable number of failed authentication attempts (max_login_attempts). This protection operates on a check-then-increment model: when an authentication request arrives, the API first checks whether the requesting account has exceeded the allowed failure threshold, then processes the credential validation, and subsequently increments the failure counter if authentication fails.

CVE-2026-93346 exploits a Time-of-Check-to-Time-of-Use (TOCTOU) race condition in this logic. When multiple authentication requests are dispatched simultaneously (concurrently), each request performs the block check before any of the sibling requests have incremented the failure counter. Consequently, a burst of N concurrent requests all pass the block check at approximately the same moment, and all N credential validation attempts execute — even though the cumulative failure count would have exceeded max_login_attempts if the requests had been processed sequentially.

The affected attack surface comprises two API endpoints explicitly identified in the vulnerability description:

• The authenticate endpoint (the primary login mechanism for the Wazuh API)
• The run_as endpoint (which allows authenticated administrative users to execute requests in the context of another user)

Both endpoints perform authentication or identity-assumption operations subject to the login throttling logic. The race condition means that an attacker with network access to the Wazuh API (default TCP port 55000) can maintain an effectively unlimited rate of password guessing by continuously issuing concurrent login bursts, as each burst resets the effective blocking window before failures are registered.

The root cause is a lack of synchronization (mutex/locking) around the check-and-increment sequence of the failure counter, allowing interleaved execution of concurrent request handlers. This is classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts), a subset of authentication weakness that directly undermines brute-force protections.

CVSS 3.1 scores this at 5.3 (Medium), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N:

• AV:N (Network) — the Wazuh API is remotely accessible over the network.
• AC:L (Low) — no special conditions beyond the ability to send concurrent HTTP requests.
• PR:N (None) — no authentication is required to attempt login.
• UI:N (None) — no user interaction required.
• C:L (Low Confidentiality) — successful credential guessing yields access to the API, which may expose configuration and alert data.
• I:N / A:N — the vulnerability itself does not directly permit data modification or denial of service.

The CVSS score reflects the indirect nature of the impact: the race condition does not itself grant access but enables a secondary attack (credential brute force) that may achieve low-confidentiality access.

Exploitation Scenarios

No public proof-of-concept (PoC) or exploit code is available for CVE-2026-93346. The following attack chain is inferred strictly from the vulnerability class (race condition in authentication throttling) and the NVD description. No specific implementation details, function names, or code patterns are fabricated.

1) Reconnaissance / Target Identification An attacker identifies internet-exposed or internally reachable Wazuh API instances, typically listening on TCP port 55000. Shodan and similar services can locate Wazuh deployments via HTTP title/body fingerprints. The attacker confirms the API version is within the vulnerable range (4.0.0 through 4.14.7).

2) Triggering the Flaw Class The attacker crafts a set of concurrent authentication requests directed at the authenticate endpoint. Instead of sending login attempts sequentially (which would trigger max_login_attempts lockout after the configured threshold), the attacker dispatches a high-volume burst of simultaneous requests. Because each request performs the block check before the failure counter is incremented by its peers, the throttling logic is bypassed. The same technique applies to the run_as endpoint.

3) Payload / Execution Method At the vulnerability-class level, the "payload" is a dictionary of candidate passwords, one per concurrent request. The attacker iterates through password candidates across repeated concurrent bursts, sustaining an effectively unlimited guessing rate. No specific request-construction details are described in the available data; the attack is purely a race-condition exploitation of the credential validation flow.

4) Post-Exploitation Impact If a correct credential is guessed, the attacker obtains a valid API session. This grants access to the Wazuh API, which could expose alert data, agent management functions, and configuration details — consistent with the CVSS Confidentiality:Low rating. The attacker may also leverage the run_as endpoint to assume the context of other users if appropriate privileges are obtained.

Impact Assessment

The primary business impact is the erosion of a critical security control — account lockout/throttling — within the very platform organizations rely upon for security monitoring. Wazuh is widely deployed as an open-source SIEM and XDR solution; compromise of its API can provide an attacker with visibility into the organization's detection capabilities, alert data, and managed endpoint inventory.

Blast radius: Any Wazuh deployment running API version 4.0.0 through 4.14.7 with a network-reachable API interface (port 55000) is potentially affected. Externally exposed APIs represent the highest risk; internal-only deployments are at reduced but non-zero risk from insider or lateral-movement attackers.

CVSS subscore implications:

• Confidentiality: Low — access to API data is possible only upon successful credential guessing, and the scope is limited to what the compromised account can read.
• Integrity: None — the vulnerability does not directly permit modification.
• Availability: None — no direct denial-of-service vector is described.

The medium (5.3) severity understates the risk in environments where weak or default API passwords are used, as the vulnerability directly enables their compromise. The absence of CISA KEV listing and public PoC/exploit code reduces immediate opportunistic exploitation risk, but the flaw is trivially automatable once understood.

Detection Guidance

Sigma Rule

title: Wazuh API Concurrent Login Throttle Bypass (CVE-2026-93346)
id: 7f3c9a12-4b8e-4d21-9c6f-0a1b2c3d4e5f
status: experimental
description: Detects bursts of concurrent authentication attempts against the Wazuh API authenticate or run_as endpoints, indicative of login throttle bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93346
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: wazuh
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/security/user/authenticate'
      - '/security/users/me/run_as'
  selection_status:
    sc-status:
      - 401
      - 403
  timeframe: 10s
  condition: selection_endpoint and selection_status | count() by src_ip > 20
fields:
  - src_ip
  - cs-uri-stem
  - sc-status
falsepositives:
  - Legitimate automated scripts with misconfigured retry logic
level: high

YARA Rule

rule CVE_2026_93346_Wazuh_Throttle_Bypass
{
    meta:
        description = "Detects concurrent login burst tooling targeting Wazuh API authenticate/run_as endpoints"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93346"
        author = "valtersit.com"
        date = "2026-01-01"
    strings:
        $ep1 = "/security/user/authenticate" ascii wide nocase
        $ep2 = "/security/users/me/run_as" ascii wide nocase
        $hdr = "Content-Type: application/json" ascii wide nocase
    condition:
        ($ep1 or $ep2) and $hdr
}

Suricata IDS Rule

alert http any any -> any 55000 (msg:"CVE-2026-93346 Wazuh API Authentication Throttle Bypass Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/security/user/authenticate"; threshold:type both, track by_src, count 20, seconds 10; classtype:attempted-user; reference:cve,2026-93346; sid:202693346; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [http where url.path == "/security/user/authenticate" and http.response.status_code in (401, 403)] with runs=20

Splunk SPL Query

index=wazuh_api sourcetype=wazuh:api_access
| search uri_path IN ("/security/user/authenticate", "/security/users/me/run_as") status IN (401, 403)
| bucket _time span=10s
| stats count AS attempts dc(uri_path) AS endpoints BY src_ip, _time
| where attempts > 20
| table _time, src_ip, attempts, endpoints

Wazuh OSSEC Rule

<group name="wazuh_api,authentication,">
  <rule id="100346" level="12" frequency="20" timeframe="10">
    <if_matched_sid>100345</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-93346: Possible Wazuh API login throttle bypass - high volume of concurrent authentication failures from same source.</description>
    <mitre>
      <id>T1110</id>
    </mitre>
    <group>authentication_failures,pci_dss_10.2.4,pci_dss_10.2.5,</group>
  </rule>
  <rule id="100345" level="5">
    <decoded_as>json</decoded_as>
    <field name="uri_path">/security/user/authenticate</field>
    <field name="status">401</field>
    <description>Wazuh API authentication failure.</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict network access to the Wazuh API (default TCP port 55000) using firewall rules, security groups, or reverse-proxy ACLs. Only trusted management hosts should reach the API.
   • Enforce strong, high-entropy API credentials to reduce the feasibility of successful password guessing even if the throttle is bypassed.
   • Deploy a fronting reverse proxy (e.g., nginx, HAProxy) capable of per-source-IP rate limiting on authentication paths, providing throttling independent of the vulnerable Wazuh logic.
   • Monitor authentication logs for high-frequency 401/403 responses from single source IPs as a compensating detection control.

2. Patch / upgrade steps:

   • No vendor fix is currently available per tracked sources. Monitor the Wazuh project's release channels and security advisories for a fixed version. Once released, upgrade all API nodes and validate that max_login_attempts enforcement functions correctly under concurrent load.

3. Long-term hardening:

   • Enforce mutual TLS (mTLS) or certificate-based authentication for API access where supported.
   • Integrate API authentication with centralized identity providers and enable multi-factor authentication at the access layer.
   • Apply least-privilege roles to API accounts and rotate credentials regularly.
   • Conduct periodic concurrency testing of authentication controls to detect reintroduced race conditions.

References

• NVD — CVE-2026-93346: https://nvd.nist.gov/vuln/detail/CVE-2026-93346
• Wazuh Project Security Advisories: https://wazuh.com/ (monitor release notes for 4.14.8+)
• CWE-307 — Improper Restriction of Excessive Authentication Attempts: https://cwe.mitre.org/data/definitions/307.html
• MITRE ATT&CK T1110 — Brute Force: https://attack.mitre.org/techniques/T1110/
• CISA Known Exploited Vulnerabilities Catalog: Not listed (as of report generation)

No known threat actor campaigns or exploit-in-the-wild evidence have been identified for CVE-2026-93346. No public PoC, exploit code, or Nuclei template is currently available.