CVE-2026-44256
Received Received - Intake

Log Forgery via CRLF in Wazuh API Authentication

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control characters. api/api/alogging.py interpolates that value into the plain-text API log. An unauthenticated attacker can include carriage returns or line feeds in the username to forge entries, obscure activity, or poison systems that consume the plain-text audit log. The JSON log format is not affected because JSON serialization escapes these characters. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-44256
EUVD
EUVD-2026-62575

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
wazuh wazuh From 4.4.0 (inc) to 4.14.6 (inc)
wazuh wazuh 5.0.0-beta2
wazuh wazuh 4.4.0
wazuh wazuh 4.14.6
wazuh wazuh From 4.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-117 The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-44256 is a vulnerability in Wazuh versions 4.4.0 to 4.14.6 and 5.0.0-beta2 where the API improperly handles usernames containing control characters like newlines or carriage returns. The username is decoded before validation and logged without neutralizing these characters, allowing log injection. The JSON log format is unaffected as it escapes special characters.

Detection Guidance

Check Wazuh API plain-text logs for entries containing unexpected newline or carriage return characters in usernames. Review logs for forged entries or unusual formatting that may indicate exploitation. Verify if your Wazuh version is below 4.14.6 or 5.0.0-beta2.

Impact Analysis

An unauthenticated attacker could forge log entries by injecting control characters into the username, obscuring real activity or poisoning systems that rely on plain-text audit logs. This could mislead log analysis or hide unauthorized actions. The impact is limited to log integrity, not direct system compromise.

Compliance Impact

This vulnerability could compromise compliance by allowing tampered audit logs, which may fail audits requiring accurate and unaltered records. For GDPR, it risks violating integrity principles for logs containing personal data. For HIPAA, it could undermine audit trail integrity for protected health information.

Mitigation Strategies

Upgrade Wazuh to version 4.14.6 or 5.0.0-beta2 or later to apply the fix. If immediate upgrade is not possible, monitor plain-text logs for suspicious entries and consider disabling plain-text logging temporarily.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44256. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart