CVE-2026-44255

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44255", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T16:33:55.844Z", "datePublished": "2026-08-19T16:15:19.929Z", "dateUpdated": "2026-08-25T02:17:14.746Z"}, "containers": {"cna": {"title": "Wazuh: Username Enumeration via Timing Side-Channel", "problemTypes": [{"descriptions": [{"cweId": "CWE-208", "lang": "en", "description": "CWE-208: Observable Timing Discrepancy", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9"}, {"name": "https://github.com/wazuh/wazuh/pull/35757", "tags": ["x_refsource_MISC"], "url": "https://github.com/wazuh/wazuh/pull/35757"}, {"name": "https://github.com/wazuh/wazuh/commit/5ecea7b38b998407cb0d205467dd247140a0f981", "tags": ["x_refsource_MISC"], "url": "https://github.com/wazuh/wazuh/commit/5ecea7b38b998407cb0d205467dd247140a0f981"}, {"name": "https://github.com/wazuh/wazuh/releases/tag/v4.14.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/wazuh/wazuh/releases/tag/v4.14.6"}, {"name": "https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2", "tags": ["x_refsource_MISC"], "url": "https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2"}], "affected": [{"vendor": "wazuh", "product": "wazuh", "versions": [{"version": ">= 4.0.0, < 4.14.6", "status": "affected"}, {"version": ">= 5.0.0-beta1, < 5.0.0-beta2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-19T16:15:19.929Z"}, "descriptions": [{"lang": "en", "value": "Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.check_user() in framework/wazuh/rbac/orm.py performs check_password_hash() only when the supplied username exists. A nonexistent username returns immediately, while a valid username causes an expensive bcrypt calculation. An unauthenticated remote attacker can compare authentication response times to enumerate valid Wazuh usernames and use that information in subsequent credential attacks. This issue is fixed in versions 4.14.6 and 5.0.0-beta2."}], "source": {"advisory": "GHSA-3978-44q9-9px9", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T02:16:49.674139Z", "id": "CVE-2026-44255", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T02:17:14.746Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44255", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T02:16:49.674139Z"}}}], "references": [{"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T02:17:10.003Z"}}], "cna": {"title": "Wazuh: Username Enumeration via Timing Side-Channel", "source": {"advisory": "GHSA-3978-44q9-9px9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "wazuh", "product": "wazuh", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.14.6"}, {"status": "affected", "version": ">= 5.0.0-beta1, < 5.0.0-beta2"}]}], "references": [{"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9", "name": "https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/wazuh/wazuh/pull/35757", "name": "https://github.com/wazuh/wazuh/pull/35757", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wazuh/wazuh/commit/5ecea7b38b998407cb0d205467dd247140a0f981", "name": "https://github.com/wazuh/wazuh/commit/5ecea7b38b998407cb0d205467dd247140a0f981", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wazuh/wazuh/releases/tag/v4.14.6", "name": "https://github.com/wazuh/wazuh/releases/tag/v4.14.6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2", "name": "https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.check_user() in framework/wazuh/rbac/orm.py performs check_password_hash() only when the supplied username exists. A nonexistent username returns immediately, while a valid username causes an expensive bcrypt calculation. An unauthenticated remote attacker can compare authentication response times to enumerate valid Wazuh usernames and use that information in subsequent credential attacks. This issue is fixed in versions 4.14.6 and 5.0.0-beta2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-208", "description": "CWE-208: Observable Timing Discrepancy"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-19T16:15:19.929Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44255", "state": "PUBLISHED", "dateUpdated": "2026-08-25T02:17:14.746Z", "dateReserved": "2026-05-05T16:33:55.844Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-19T16:15:19.929Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "wazuh", "vendor": "wazuh", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.14.6"}, {"status": "affected", "version": ">= 5.0.0-beta1, < 5.0.0-beta2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*", "matchCriteriaId": "E34130E3-89D7-4413-B1F0-0434248CD325", "versionEndExcluding": "4.14.6", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wazuh:wazuh:5.0.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "007B01AA-AED0-4E92-8999-07E74B630460", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.check_user() in framework/wazuh/rbac/orm.py performs check_password_hash() only when the supplied username exists. A nonexistent username returns immediately, while a valid username causes an expensive bcrypt calculation. An unauthenticated remote attacker can compare authentication response times to enumerate valid Wazuh usernames and use that information in subsequent credential attacks. This issue is fixed in versions 4.14.6 and 5.0.0-beta2."}, {"lang": "es", "value": "Wazuh es una plataforma de c\u00f3digo abierto y gratuita utilizada para la prevenci\u00f3n, detecci\u00f3n y respuesta a amenazas. Desde la versi\u00f3n 4.0.0 hasta la 4.14.6 y la 5.0.0-beta2, AuthenticationManager.check_user() en framework/wazuh/rbac/orm.py realiza check_password_hash() solo cuando el nombre de usuario proporcionado existe. Un nombre de usuario inexistente retorna inmediatamente, mientras que un nombre de usuario v\u00e1lido provoca un c\u00e1lculo bcrypt costoso. Un atacante remoto no autenticado puede comparar los tiempos de respuesta de autenticaci\u00f3n para enumerar nombres de usuario v\u00e1lidos de Wazuh y utilizar esa informaci\u00f3n en ataques de credenciales posteriores. Este problema est\u00e1 solucionado en las versiones 4.14.6 y 5.0.0-beta2."}], "id": "CVE-2026-44255", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44255", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T02:16:49.674139Z", "version": "2.0.3"}}]}, "published": "2026-08-19T17:18:48.770", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/wazuh/wazuh/commit/5ecea7b38b998407cb0d205467dd247140a0f981"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/wazuh/wazuh/pull/35757"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/wazuh/wazuh/releases/tag/v4.14.6"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-208"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.14.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0-beta1,5.0.0-beta2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "wazuh", "source": "cna", "vendor": "wazuh"}, "product": "wazuh", "vendor": "wazuh"}], "created": "2026-08-19T18:45:03.577713+00:00", "updated": "2026-08-20T14:15:05.158076+00:00", "vendors": ["wazuh", "wazuh$PRODUCT$wazuh"]}