CVE-2026-49392: Wazuh SQL Injection Vulnerability

CVE-2026-49392 Overview

CVE-2026-49392 is a SQL injection vulnerability in Wazuh, an open source platform for threat prevention, detection, and response. The flaw exists in the File Integrity Monitoring (FIM) component, specifically in DB::getFile() and DB::searchFile() within src/syscheckd/src/db/src/file.cpp. These functions concatenate monitored file paths into SQLite row filters without proper escaping. On non-Windows systems, FIMDBCreator::encodeString() does not sanitize the path value. A local user who can create a filename inside a monitored FIM directory can inject a UNION SELECT expression that wazuh-syscheckd executes when processing or deleting the path. The issue affects versions 4.6.0 through 4.14.5 and 5.0.0-beta2.

Critical Impact
A local attacker with write access to a monitored directory can manipulate SQLite SELECT result sets consumed by the Wazuh FIM database, corrupting integrity data used for security monitoring.

Affected Products

Wazuh 4.6.0 through 4.14.5 (non-Windows platforms)
Wazuh 5.0.0-beta1 and 5.0.0-beta2
wazuh-syscheckd File Integrity Monitoring component

Discovery Timeline

2026-08-19 - CVE-2026-49392 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-49392

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-20] rooted in unsafe query construction. Wazuh's FIM subsystem stores metadata about monitored files in a SQLite database. When wazuh-syscheckd looks up or deletes a file record, DB::getFile() and DB::searchFile() build a row filter by concatenating the file path directly into the SQL statement. On Linux and other non-Windows systems, FIMDBCreator::encodeString() performs no escaping of embedded quote characters or SQL metacharacters.

A local user who can create files inside any directory monitored by FIM controls part of that concatenated query. By crafting a filename that closes the current string literal and appends a UNION SELECT clause, the attacker alters the result set the FIM code consumes. The confirmed impact is manipulation of query results. Stacked statements and remote code execution were not demonstrated by the reporter.

Root Cause

The root cause is improper input validation combined with string concatenation for SQL query construction. The encodeString() routine on non-Windows platforms fails to escape user-controllable filename bytes before they are placed into the SQLite row filter, violating the principle of separating code from data.

Attack Vector

Exploitation requires local access with permission to create a file whose name will be observed by wazuh-syscheckd. The attacker places a file with a crafted name in a monitored FIM path. When the daemon enumerates or deletes that path, the injected SQL executes against the FIM SQLite database. No user interaction and no elevated privileges beyond filesystem write access to a monitored location are required.

cpp

// Patch: src/shared_modules/dbsync/src/dbsync.cpp
// Introduces parameterized row-filter bindings replacing string concatenation.
SelectQuery& SelectQuery::rowFilterBindText(const std::string& value)
{
    nlohmann::json param;
    param["type"] = "text";
    param["value"] = value;
    m_jsQuery["query"]["row_filter_params"].push_back(param);
    return *this;
}

SelectQuery& SelectQuery::rowFilterBindInt(const int64_t value)
{
    nlohmann::json param;
    param["type"] = "int";
    param["value"] = value;
    m_jsQuery["query"]["row_filter_params"].push_back(param);
    return *this;
}
// Source: https://github.com/wazuh/wazuh/commit/8e4e25b971dfb7b15bc492f10f8a350e6b37e70e

Detection Methods for CVE-2026-49392

Indicators of Compromise

Filenames in FIM-monitored directories containing SQL syntax fragments such as single quotes, UNION SELECT, or -- comment sequences.
Unexpected entries or missing records in the Wazuh FIM SQLite database (fim.db).
wazuh-syscheckd log entries showing SQLite errors or malformed query warnings when scanning monitored paths.

Detection Strategies

Audit filesystem create events in FIM-monitored directories for filenames containing SQL metacharacters using auditd or eBPF-based file monitoring.
Compare Wazuh FIM alert output against ground-truth file listings to identify manipulated result sets.
Review wazuh-syscheckd process telemetry for unexpected SQLite operations or database access anomalies.

Monitoring Recommendations

Alert on file creation events where filenames contain characters uncommon in legitimate paths, such as ', ", or ;.
Track the installed Wazuh agent version across the fleet and flag hosts running versions between 4.6.0 and 4.14.5.
Monitor integrity of fim.db and correlate with unexpected wazuh-syscheckd restarts or errors.

How to Mitigate CVE-2026-49392

Immediate Actions Required

Upgrade Wazuh agents to version 4.14.6 or 5.0.0-beta3 on all non-Windows hosts.
Inventory FIM-monitored directories and restrict write permissions to trusted users only.
Review recent FIM alerts on affected agents for possible tampering with integrity data.

Patch Information

The vulnerability is fixed in Wazuh 4.14.6 and 5.0.0-beta3. The patch replaces string concatenation in FIM database queries with parameterized SQLite bindings via new rowFilterBindText() and rowFilterBindInt() APIs. See the GitHub Security Advisory GHSA-9c4x-mrjh-rmw5, the fix commit, and the Wazuh v4.14.6 release notes.

Workarounds

Remove world-writable and shared directories from the FIM configuration until agents are patched.
Restrict shell and file-creation access on monitored hosts to reduce the pool of users who can plant malicious filenames.
Deploy filesystem access controls, such as noexec and stricter umask values, to limit adversary-controlled filenames in monitored paths.

bash

# Verify installed Wazuh agent version and confirm it is patched
/var/ossec/bin/wazuh-control info | grep WAZUH_VERSION
# Expected output on patched systems: WAZUH_VERSION="v4.14.6" or later