CVE-2026-74041 Overview
CVE-2026-74041 is a remote command validation bypass in Wazuh versions 4.14.3 before 4.14.8. The flaw stems from a case-sensitivity mismatch between the ossec.conf validator and the wazuh-logcollector component. An authenticated user holding the manager:update_config permission can inject an uppercase LOG_FORMAT command localfile entry. The validator fails to recognize the uppercase variant as a remote command, while wazuh-logcollector executes it as root on configuration reload.
Critical Impact
Authenticated manager users can achieve arbitrary command execution as root on the Wazuh manager host by abusing a case-sensitivity gap in configuration validation.
Affected Products
- Wazuh 4.14.3
- Wazuh versions after 4.14.3 and prior to 4.14.8
- Wazuh Manager (wazuh-logcollector component)
Discovery Timeline
- 2026-10-13 - CVE-2026-74041 published to NVD
- 2026-10-14 - Last updated in NVD database
- Wazuh 4.14.8 - Vendor releases patched version
Technical Details for CVE-2026-74041
Vulnerability Analysis
The vulnerability is classified under [CWE-178: Improper Handling of Case Sensitivity]. Wazuh validates ossec.conf to prevent users with manager:update_config from configuring arbitrary remote commands through localfile entries. The validator performs a case-sensitive comparison when checking the log_format field for the value command or full_command. The wazuh-logcollector daemon, however, performs case-insensitive matching when parsing the same field at runtime.
This mismatch creates a parser differential. A localfile block containing LOG_FORMAT in uppercase slips past the validator but is still interpreted by the collector as a remote command directive. On the next configuration reload, wazuh-logcollector executes the attacker-supplied command as the root user that owns the daemon.
Root Cause
The root cause is inconsistent string normalization across two components that must agree on policy. The validator and the collector do not share a canonicalization routine for configuration field names and values. Any divergence between the enforcement layer and the execution layer enables bypass of command restrictions enforced by role-based access control.
Attack Vector
Exploitation requires network access to the Wazuh manager API and valid credentials with the manager:update_config permission. The attacker submits a crafted ossec.conf fragment through the configuration update API. The payload defines a localfile block with an uppercase LOG_FORMAT value and an attacker-chosen command field. When the manager reloads its configuration, wazuh-logcollector runs the command as root, yielding full host compromise and lateral movement into monitored infrastructure.
Technical details and the vendor fix are documented in the GitHub Security Advisory GHSA-cjf8-wjx6-hjw6 and the VulnCheck advisory.
Detection Methods for CVE-2026-74041
Indicators of Compromise
- localfile blocks in ossec.conf where log_format is set to any case variant other than lowercase command or full_command, such as LOG_FORMAT, Command, or FULL_COMMAND.
- Unexpected child processes spawned by wazuh-logcollector running as root.
- Configuration push events through the Wazuh manager API originating from accounts with manager:update_config that modify localfile sections.
Detection Strategies
- Audit all ossec.conf files on managers for localfile entries and flag any log_format value that is not strictly lowercase.
- Monitor Wazuh manager API logs for configuration update calls and correlate them with the submitting principal and payload content.
- Alert on process creation events where the parent is wazuh-logcollector and the child is a shell, interpreter, or network utility.
Monitoring Recommendations
- Ingest Wazuh manager audit logs and process telemetry into a central analytics platform and build detections around wazuh-logcollector process ancestry.
- Track every change to manager:update_config role assignments and require review for new grants.
- Baseline normal localfile configurations and alert on structural drift following any configuration reload event.
How to Mitigate CVE-2026-74041
Immediate Actions Required
- Upgrade all Wazuh managers to version 4.14.8 or later without delay.
- Review the current ossec.conf on every manager for localfile blocks containing non-lowercase log_format values and remove them.
- Rotate credentials and API keys for any account holding manager:update_config if the manager was exposed to untrusted users.
Patch Information
The fix is included in Wazuh Release v4.14.8. The release normalizes log_format handling so the validator and wazuh-logcollector agree on which values represent remote command directives. Apply the upgrade according to the vendor's standard manager upgrade procedure and restart the manager services.
Workarounds
- Restrict the manager:update_config permission to a minimal set of trusted administrators until the patch is applied.
- Place the Wazuh manager API behind network controls that limit access to known administrative hosts.
- Implement file integrity monitoring on ossec.conf and reject reloads that introduce localfile blocks with non-lowercase log_format values.
# Example audit command to find suspicious localfile log_format values
grep -niE '<log_format>[^<]*[A-Z][^<]*</log_format>' /var/ossec/etc/ossec.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.