# CVE-2026-44256: Wazuh API log injection via unvalidated Basic auth username

Source: https://junglewise.ai/threats/cve-2026-44256-wazuh-api-log-injection-via-unvalidated-basic-auth-username  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-44256 · Severity: medium · CVSS 5.3 · Published 2026-08-19

Wazuh is a security platform used for threat detection and incident response. The Wazuh API fails to validate or sanitize usernames in Basic authentication requests before logging them in plain-text audit logs. An attacker can inject carriage returns or line feeds into the username field to forge fake log entries, hide malicious activity, or corrupt audit logs that security teams rely on for compliance and investigations.

Technologies: [Wazuh](https://junglewise.ai/threats/technologies/wazuh). Vendors: [Wazuh](https://junglewise.ai/threats/vendors/wazuh).

## Quick answers

**Is CVE-2026-44256 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44256 being exploited in the wild.

**How severe is CVE-2026-44256?** Medium severity, with a CVSS score of 5.3, published 19 August 2026.

**Which products and versions are affected?** Wazuh 4.4.0 to 4.14.5, 5.0.0-beta1.

**Is there a fix for CVE-2026-44256?** A patch was published on 2026-05-04: Fix merged for versions 4.14.6 and 5.0.0-beta2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44256 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44256?** Check whether you run Wazuh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a log injection flaw in the Wazuh API framework. The vulnerable code in api/middlewares.py decodes the Basic authentication username and passes it directly to the access logger in api/alogging.py without sanitizing control characters (newlines, carriage returns, tabs). An unauthenticated attacker can craft a malicious Basic auth header with embedded control characters in the username to break log lines, forge new entries, or obscure their activity. This affects plain-text API logs; the JSON log format is not vulnerable because JSON serialization automatically escapes these characters. The fix validates and sanitizes usernames to strip control characters before logging. Fixed in versions 4.14.6 and 5.0.0-beta2.

## Affected products

- Wazuh Wazuh 4.4.0 to 4.14.5, 5.0.0-beta1

## Timeline

- 2026-08-19: disclosed
- 2026-05-04: patched: Fix merged for versions 4.14.6 and 5.0.0-beta2

## References

- [https://github.com/wazuh/wazuh/commit/cddf3fd16b0f945b28eb9c27714de3cc344e0926](https://github.com/wazuh/wazuh/commit/cddf3fd16b0f945b28eb9c27714de3cc344e0926)
- [https://github.com/wazuh/wazuh/pull/35866](https://github.com/wazuh/wazuh/pull/35866)

## Related threats

- [Wazuh heap buffer overflow in Windows EventChannel decoder](https://junglewise.ai/threats/cve-2026-62365-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh unauthenticated memory exhaustion in cluster listener](https://junglewise.ai/threats/cve-2026-71540-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh stack exhaustion in XML parser via element attributes](https://junglewise.ai/threats/cve-2026-61811-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh cluster key disclosure in GET /cluster/local/config](https://junglewise.ai/threats/cve-2026-61802-wazuh-cluster-key-disclosure-in-get-cluster-local-config)
- [Wazuh arbitrary file write in cluster worker file sync](https://junglewise.ai/threats/cve-2026-61800-wazuh-arbitrary-file-write-in-cluster-worker-file-sync)