CVE-2026-44256mediumCWE-117

CVE-2026-44256: falha de média gravidade em wazuh

Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username

Publicada em

Seguir esta CVE+ Monitorar wazuh

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.5%
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control characters. api/api/alogging.py interpolates that value into the plain-text API log. An unauthenticated attacker can include carriage returns or line feeds in the username to forge entries, obscure activity, or poison systems that consume the plain-text audit log. The JSON log format is not affected because JSON serialization escapes these characters. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
wazuh · wazuh
CVEs relacionadas — wazuh

No mesmo produto, das mais perigosas para as menos.

CVE-2025-24016CRITICALRemote code execution in Wazuh serverEPSS 93.8%KEVCVE-2023-50260HIGHWazuh's vulnerability in host_deny AR script allows arbitrary command executionEPSS 41.2%CVE-2026-25769CRITICALWazuh Cluster vulnerable to Remote Code Execution via Insecure DeserializationEPSS 9.1%CVE-2024-32038CRITICALWazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-25770CRITICALWazuh has Privilege Escalation to Root via Cluster Protocol File WriteEPSS 1.0%CVE-2026-61800CRITICALWazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)EPSS 1.0%