CVE-2026-54085: Wazuh: Missing input validation in multiple active response scripts allows argument injection
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, allowing argument injection into tools that run as root. Five of the eight scripts that handle the srcip field, route-null.c, netsh.c, pf.c, npf.c, and ipfw.c, omit the getipversion() check that rejects non-IP input, and disable-account.c passes the dstuser field to passwd/chuser with only a comparison against "root". An attacker who can inject crafted log events, for example via syslog, can supply srcip or dstuser values that, when an active response rule triggers, are passed unvalidated to firewall and account-management commands such as pfctl, npfctl, ipfw, route, netsh, and passwd. This enables injecting additional command arguments, and on Windows the unquoted CreateProcess command-line concatenation in wpopenv() lets a srcip containing spaces add further arguments, while disable-account.c can be abused to lock arbitrary system accounts. This issue is fixed in version 4.14.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuh active response (multiple scripts)to a version that resolves this vulnerability.Fixed in 4.14.7
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Deployments running Wazuh 4.2.0 through 4.14.6 are exposed if they use an affected active response script and an attacker can inject crafted log events, such as through syslog, that cause the corresponding active response rule to trigger.
What does an attacker need to exploit this issue?
The attacker needs the ability to influence alert fields used by an active response rule, specifically srcip for the affected firewall and route scripts or dstuser for disable-account.c. No user interaction is required, but the crafted event must trigger the relevant active response.
Which active response scripts are affected?
The affected srcip-handling scripts are route-null.c, netsh.c, pf.c, npf.c, and ipfw.c. The disable-account.c script is also affected because it passes dstuser to passwd or chuser after only checking whether the value is "root".
What can happen if exploitation succeeds?
An attacker can inject additional arguments into privileged firewall, routing, or account-management commands. On Windows, a srcip value containing spaces can add arguments through unquoted CreateProcess command-line concatenation; disable-account.c can be abused to lock arbitrary system accounts.
What should be done to remediate the issue?
Upgrade Wazuh to version 4.14.7, which fixes the issue. If an immediate upgrade is not possible, avoid using the affected active response scripts and prevent untrusted sources from injecting log events that could trigger active response rules.