Vulnerability in Wazuh Platform's Authentication Logging Mechanism
CVE-2026-44256
What is CVE-2026-44256?
The Wazuh platform, utilized for threat detection and response, has a vulnerability due to improper handling of Basic authentication usernames. In specific versions, the platform decodes usernames before validating credentials, allowing an unauthorized user to inject control characters, such as carriage returns or line feeds. This can lead to the creation of forged log entries, obscuring activities or compromising systems that utilize the plaintext access logs. Notably, this flaw does not affect JSON formatted logs since they appropriately escape these characters. The vulnerability has been addressed in Wazuh versions 4.14.6 and 5.0.0-beta2.
Affected Version(s)
wazuh >= 4.4.0, < 4.14.6 < 4.4.0, 4.14.6
wazuh >= 5.0.0-beta1, < 5.0.0-beta2 < 5.0.0-beta1, 5.0.0-beta2