CVE-2026-44256 wazuh CVE debrief

Who should care

Defenders and administrators of Wazuh installations should assess exposure and prioritize updating to prevent log poisoning and ensure the integrity of audit logs. This includes reviewing and cleaning up plain-text API logs for potential log poisoning, implementing additional logging and monitoring, and verifying the integrity of audit logs.

Why it matters

Defenders should prioritize verifying and updating Wazuh installations to prevent log poisoning and ensure the integrity of audit logs, as an unauthenticated attacker can forge entries, obscure activity, or poison systems that consume the plain-text audit log.

• An unauthenticated attacker can forge entries in the plain-text API log.
• An unauthenticated attacker can obscure activity in the plain-text API log.
• An unauthenticated attacker can poison systems that consume the plain-text audit log.
• Verify Wazuh installations for potential log poisoning and update to 4.14.6 or 5.0.0-beta2.

Technical summary

The Wazuh platform's API log is vulnerable to log poisoning due to the lack of neutralization of control characters in the Basic authentication username. This occurs because the username is decoded before credential validation and then included in the plain-text API log. The vulnerability affects Wazuh versions from 4.4.0 to 4.14.6 and 5.0.0-beta2, and it is fixed in versions 4.14.6 and 5.0.0-beta2. The JSON log format is not affected due to JSON serialization escaping these characters. Defenders should prioritize verifying and updating Wazuh installations to prevent log poisoning and ensure the integrity of audit logs.

Defensive priority

Defenders should prioritize verifying and updating Wazuh installations to prevent log poisoning and ensure the integrity of audit logs.

Recommended defensive actions

• Verify Wazuh installations for version 4.4.0 to 4.14.6 or 5.0.0-beta2 and update to 4.14.6 or 5.0.0-beta2
• Review and clean up plain-text API logs for potential log poisoning
• Implement additional logging and monitoring to detect potential log manipulation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The issue is caused by the decoding of the Basic authentication username before credential validation and its inclusion in the plain-text API log without neutralizing control characters. The JSON log format is not affected because JSON serialization escapes these characters. The vulnerability was identified in Wazuh versions 4.4.0 through 4.14.6 and 5.0.0-beta2, and it is addressed in versions 4.14.6 and 5.0.0-beta2.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.