CVE-2026-44256: Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control characters. api/api/alogging.py interpolates that value into the plain-text API log. An unauthenticated attacker can include carriage returns or line feeds in the username to forge entries, obscure activity, or poison systems that consume the plain-text audit log. The JSON log format is not affected because JSON serialization escapes these characters. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 4.14.6 - Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 5.0.0-beta2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Wazuh versions from 4.4.0 through 4.14.6, and version 5.0.0-beta2, are identified as affected when using the plain-text API log format. The JSON log format is not affected.
Does exploitation require valid API credentials or user interaction?
No. An unauthenticated network attacker can supply carriage return or line feed characters in a Basic Authentication username before credential validation.
What is the impact of a successful exploit?
An attacker can forge plain-text API log entries, obscure activity, or poison systems that consume the audit log. The stated impact is limited to log integrity; confidentiality and availability are not affected.
What should be done if upgrading is not immediately possible?
Use the JSON API log format, which escapes these characters and is not affected, rather than the plain-text API log format. Review plain-text API logs and any downstream systems consuming them for potentially forged or malformed entries.