EUVD-2026-62575Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible API exploitable without credentials (injection precedes authentication), with impact confined to plain-text log integrity and no confidentiality or availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control characters. api/api/alogging.py interpolates that value into the plain-text API log. An unauthenticated attacker can include carriage returns or line feeds in the username to forge entries, obscure activity, or poison systems that consume the plain-text audit log. The JSON log format is not affected because JSON serialization escapes these characters. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
AnalysisAI
Log injection in Wazuh's REST API (versions 4.4.0 through pre-4.14.6 and 5.0.0-beta1 through pre-5.0.0-beta2) allows an unauthenticated remote attacker to corrupt plain-text audit log integrity by embedding carriage return or line feed characters in the Basic authentication username field. Because the API middleware decodes the username before credential validation and passes the raw value to the access logger without control-character neutralization, the attacker can forge log entries, suppress evidence of prior activity, or poison upstream log aggregation pipelines. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond network reachability of the Wazuh API endpoint - the injection occurs before any credential validation, so the attacker does not need valid credentials, a valid account, or any prior access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 (Medium) rating with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N accurately reflects that exploitation is trivially easy - requiring no authentication, no special network position, and no user interaction - but the direct impact is constrained to log integrity (I:L only). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Wazuh 4.14.6 (https://github.com/wazuh/wazuh/releases/tag/v4.14.6) or, for beta deployments, to 5.0.0-beta2 (https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2); these are the vendor-confirmed fixed releases per the GitHub security advisory GHSA-c3m6-fp2h-wmr4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl comman
Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in version
Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that alr
Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running v
A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achi
Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or dele
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversa
Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-pr
CVE-2024-1243 is an improper input validation vulnerability in Wazuh agent for Windows (versions prior to 4.8.0) that al
Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who
Cluster secret exposure in Wazuh 4.14.0-4.14.6 stems from a logic inversion in the RBAC masking gate that counterintuiti
Same weakness CWE-117 – Improper Output Neutralization for Logs
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today