CVE-2026-74041: Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch
Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:updateconfig can inject an uppercase LOGFORMAT command localfile that the collector runs as root on reload.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 4.14.8
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated and have the manager:update_config permission. No user interaction is required.
Which deployments are affected?
Wazuh versions 4.14.3 through versions before 4.14.8 are affected. Version 4.14.8 is identified as the fixed release.
What level of access can successful exploitation provide?
The injected command is run by wazuh-logcollector as root when it reloads. This can result in root-level command execution on the affected system.