CVE-2026-44256

{
  "id": "CVE-2026-44256",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-19T17:18:48.930",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control characters. api/api/alogging.py interpolates that value into the plain-text API log. An unauthenticated attacker can include carriage returns or line feeds in the username to forge entries, obscure activity, or poison systems that consume the plain-text audit log. The JSON log format is not affected because JSON serialization escapes these characters. This issue is fixed in versions 4.14.6 and 5.0.0-beta2."
    },
    {
      "lang": "es",
      "value": "Wazuh es una plataforma de código abierto y gratuita utilizada para la prevención, detección y respuesta ante amenazas. Desde la versión 4.4.0 hasta la 4.14.6 y la 5.0.0-beta2, api/api/middlewares.py decodifica el nombre de usuario de la autenticación Basic antes de la validación de credenciales y lo pasa al registrador de acceso sin neutralizar los caracteres de control. api/api/alogging.py interpola ese valor en el registro de la API en texto plano. Un atacante no autenticado puede incluir retornos de carro o saltos de línea en el nombre de usuario para falsificar entradas, oscurecer la actividad o envenenar sistemas que consumen el registro de auditoría en texto plano. El formato de registro JSON no se ve afectado porque la serialización JSON escapa estos caracteres. Este problema se ha solucionado en las versiones 4.14.6 y 5.0.0-beta2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "wazuh",
          "product": "wazuh",
          "versions": [
            {
              "version": ">= 4.4.0, < 4.14.6",
              "status": "affected"
            },
            {
              "version": ">= 5.0.0-beta1, < 5.0.0-beta2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-19T18:17:23.310124Z",
          "id": "CVE-2026-44256",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-117"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.4.0",
              "versionEndExcluding": "4.14.6",
              "matchCriteriaId": "D543FB80-4465-4A81-94EA-22BF728B8EAF"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:wazuh:wazuh:5.0.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "007B01AA-AED0-4E92-8999-07E74B630460"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/wazuh/wazuh/commit/cddf3fd16b0f945b28eb9c27714de3cc344e0926",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/wazuh/wazuh/pull/35866",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/wazuh/wazuh/releases/tag/v4.14.6",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-c3m6-fp2h-wmr4",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}