CVE-2026-44256 wazuh CVE debrief

Who should care

Defenders and administrators of Wazuh installations should assess exposure and prioritize updates to prevent log tampering. This includes verifying Wazuh version and log file integrity, and considering additional log monitoring and security measures. Security teams and vulnerability management teams should also review the vulnerability and implement compensating controls for exposed systems.

Why it matters

CVE-2026-44256 allows an unauthenticated attacker to forge entries in Wazuh's plain-text API log by including control characters in the Basic authentication username. Defenders should prioritize verifying and updating Wazuh installations to prevent log tampering and potential system poisoning.

• Potential log obscuration or tampering
• Possible poisoning of systems consuming plain-text audit logs
• Need for verification of Wazuh version and log file integrity
• Priority for updating Wazuh to fixed versions

Technical summary

The Wazuh platform's API decodes the Basic authentication username before validation and logs it without neutralizing control characters, allowing an unauthenticated attacker to forge log entries. This vulnerability affects Wazuh versions from 4.4.0 until 4.14.6 and 5.0.0-beta2, and is fixed in versions 4.14.6 and 5.0.0-beta2. The JSON log format is not affected due to JSON serialization escaping control characters. Defenders should prioritize verifying and updating Wazuh installations to prevent log tampering and potential system poisoning.

Defensive priority

Defenders should prioritize verifying and updating Wazuh installations to prevent log tampering.

Recommended defensive actions

• Verify Wazuh installations for exposure to unauthenticated log tampering
• Update Wazuh to version 4.14.6 or 5.0.0-beta2 to fix the issue
• Monitor plain-text API logs for suspicious entries
• Consider implementing additional log monitoring and security measures
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The issue is fixed in Wazuh versions 4.14.6 and 5.0.0-beta2. The JSON log format is not affected due to JSON serialization escaping control characters. Evidence from the source indicates that an unauthenticated attacker can include carriage returns or line feeds in the username to forge entries, obscure activity, or poison systems that consume the plain-text audit log.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.