What’s Vulnerable › Vulnerabilities

CVE-2026-44255: Wazuh: Username Enumeration via Timing Side-Channel

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-08-19 · updated 2026-10-26
• Weakness: CWE-208

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.check_user() in framework/wazuh/rbac/orm.py performs check_password_hash() only when the supplied username exists. A nonexistent username returns immediately, while a valid username causes an expensive bcrypt calculation. An unauthenticated remote attacker can compare authentication response times to enumerate valid Wazuh usernames and use that information in subsequent credential attacks. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

Affected products

• wazuh: from 4.0.0 before 4.14.6; 5.0.0-beta1 — fixed in 4.14.6

How to fix

Upgrade to a fixed version: wazuh 4.14.6. Check the vendor advisory for mitigations.

References

• https://github.com/wazuh/wazuh/commit/5ecea7b38b998407cb0d205467dd247140a0f981
• https://github.com/wazuh/wazuh/pull/35757
• https://github.com/wazuh/wazuh/releases/tag/v4.14.6
• https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2
• https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9
• https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9

Get alerted when CVE-2026-44255 or the next vulnerability affects your stack