Executive brief
Wazuh is a security platform used for threat detection and incident response. The Wazuh API fails to validate or sanitize usernames in Basic authentication requests before logging them in plain-text audit logs. An attacker can inject carriage returns or line feeds into the username field to forge fake log entries, hide malicious activity, or corrupt audit logs that security teams rely on for compliance and investigations.
Technical details
The vulnerability is a log injection flaw in the Wazuh API framework. The vulnerable code in api/middlewares.py decodes the Basic authentication username and passes it directly to the access logger in api/alogging.py without sanitizing control characters (newlines, carriage returns, tabs). An unauthenticated attacker can craft a malicious Basic auth header with embedded control characters in the username to break log lines, forge new entries, or obscure their activity. This affects plain-text API logs; the JSON log format is not vulnerable because JSON serialization automatically escapes these characters. The fix validates and sanitizes usernames to strip control characters before logging. Fixed in versions 4.14.6 and 5.0.0-beta2.
Affected products
- Wazuh Wazuh 4.4.0 to 4.14.5, 5.0.0-beta1
Timeline
- 2026-08-19: disclosed
- 2026-05-04: patched: Fix merged for versions 4.14.6 and 5.0.0-beta2