YAML Alias Expansion Vulnerability in Wazuh from 3.9.0 to 4.14.8

CVE-2026-74030

What is CVE-2026-74030?

An uncontrolled YAML alias expansion vulnerability has been identified in Wazuh, affecting versions from 3.9.0 up to, but not including, 4.14.8. This flaw is present in the yaml2json_node function, where an attacker with manager privileges can manipulate a policy to create deeply nested alias structures. When these aliases are processed, they can lead to excessive memory consumption, causing the wazuh-modulesd process on agents to be killed due to out-of-memory errors. It’s crucial for users to upgrade to version 4.14.8 or later to mitigate this issue.

References