CVE-2026-44256: Wazuh Log Injection Vulnerability

CVE-2026-44256 Overview

CVE-2026-44256 is a log injection vulnerability [CWE-117] in Wazuh, an open source platform for threat prevention, detection, and response. The flaw exists in the API middleware api/api/middlewares.py, which decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control characters. The logger in api/api/alogging.py then interpolates the value into the plain-text API log. Affected versions span from 4.4.0 through 4.14.5 and 5.0.0-beta1. Fixes ship in 4.14.6 and 5.0.0-beta2.

Critical Impact
An unauthenticated attacker can inject carriage returns or line feeds into the username field to forge log entries, obscure attacker activity, or poison downstream systems that consume the plain-text audit log.

Affected Products

Wazuh 4.4.0 through 4.14.5
Wazuh 5.0.0-beta1
Wazuh API components api/api/middlewares.py and api/api/alogging.py

Discovery Timeline

2026-08-19 - CVE-2026-44256 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-44256

Vulnerability Analysis

Wazuh exposes an authenticated REST API that accepts HTTP Basic authentication. The middleware decodes the Base64-encoded username:password pair and extracts the username before validating credentials. The decoded username is passed to the access logger regardless of authentication outcome. Because the plain-text log format writes the username directly into a line-oriented file, control characters in the decoded value break the one-record-per-line contract. Attackers can send crafted Basic authentication headers to inject arbitrary content into the audit trail. The JSON log format is not affected because JSON serialization escapes control characters during output.

Root Cause

The root cause is missing output neutralization for logs, mapped to [CWE-117]. The middlewares.py code path decodes the Basic authentication username and forwards it to the logger without filtering \n, \r, or \t characters. The logger in alogging.py interpolates the string into a plain-text template used for API access records.

Attack Vector

Exploitation requires only network reachability to the Wazuh API. The attacker crafts a Basic authentication header where the Base64-decoded username contains embedded newline or carriage-return sequences. When the request hits the middleware, the decoded username flows into the plain-text log. The forged bytes appear as separate log lines and can impersonate legitimate entries, break log parsers, or inject content that downstream SIEM systems ingest as authentic records.

python

         except (KeyError, IndexError, binascii.Error, jwt.exceptions.PyJWTError, OAuthProblem):
             user = UNKNOWN_USER_STRING
 
+    # Sanitize username to escape control characters
+    if user and user != UNKNOWN_USER_STRING:
+        # Check if username contains control characters and log a warning
+        if any(c in user for c in ['\n', '\r', '\t']):
+            logger.warning(
+                f'Username contains control characters. User: {user!r}, IP: {host}, '
+                f'Path: {path}.'
+            )
+        user = user.replace('\n', '\\n').replace('\r', '\\r').replace('\t', '\\t')
+
     # Create hash if run_as login
     if not hash_auth_context and path == RUN_AS_LOGIN_ENDPOINT:
         hash_auth_context = hashlib.blake2b(json.dumps(body).encode(),

Source: Wazuh Commit cddf3fd. The patch escapes \n, \r, and \t in the decoded username and emits a warning when control characters are detected.

Detection Methods for CVE-2026-44256

Indicators of Compromise

Wazuh API access log lines that appear malformed, duplicated, or contain unexpected field boundaries.
Log entries where the username field contains escaped sequences such as \n or \r after applying the patch, indicating attempted injection attempts.
Basic authentication requests from unauthenticated sources where the decoded username exceeds normal length or contains non-printable bytes.

Detection Strategies

Compare the JSON API log format against the plain-text log format for the same time window and flag records that exist in one but not the other.
Alert on the warning message Username contains control characters emitted by the patched middleware.
Parse Basic authentication headers at an upstream reverse proxy and reject requests where the decoded username contains CR, LF, or TAB bytes.

Monitoring Recommendations

Enable the JSON log format for the Wazuh API and forward it to a SIEM for authoritative auditing.
Monitor for spikes in authentication failures paired with unusual username content, which can indicate log-forging attempts.
Track access to the Wazuh API from network segments that should not authenticate to the management plane.

How to Mitigate CVE-2026-44256

Immediate Actions Required

Upgrade Wazuh to version 4.14.6 or 5.0.0-beta2, which sanitize control characters in the decoded Basic authentication username.
Restrict network access to the Wazuh API to trusted management networks using firewall rules or a reverse proxy allow-list.
Switch API logging to the JSON format until the patched version is deployed, since JSON serialization escapes the offending control characters.

Patch Information

The fix is available in Wazuh Release v4.14.6 and Wazuh Beta Release v5.0.0-beta2. The code change is tracked in Wazuh Pull Request #35866 and merged as commit cddf3fd16b0f945b28eb9c27714de3cc344e0926. Full advisory details are published as GHSA-c3m6-fp2h-wmr4.

Workarounds

Configure the Wazuh API to write only the JSON log format, since JSON escaping neutralizes carriage return and line feed injection.
Terminate Basic authentication at a reverse proxy that decodes the header and rejects usernames containing CR, LF, or TAB bytes before forwarding.
Isolate the Wazuh API behind a VPN or management-only network to reduce unauthenticated exposure until the upgrade is complete.

bash

# Example: switch Wazuh API logging to JSON format
# /var/ossec/api/configuration/api.yaml
logs:
  level: info
  format: json

# Restart the API service after editing the configuration
systemctl restart wazuh-manager