CVE-2026-44256

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44256", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T16:33:55.844Z", "datePublished": "2026-08-19T16:21:49.920Z", "dateUpdated": "2026-08-19T18:18:11.834Z"}, "containers": {"cna": {"title": "Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username", "problemTypes": [{"descriptions": [{"cweId": "CWE-117", "lang": "en", "description": "CWE-117: Improper Output Neutralization for Logs", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/wazuh/wazuh/security/advisories/GHSA-c3m6-fp2h-wmr4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-c3m6-fp2h-wmr4"}, {"name": "https://github.com/wazuh/wazuh/pull/35866", "tags": ["x_refsource_MISC"], "url": "https://github.com/wazuh/wazuh/pull/35866"}, {"name": "https://github.com/wazuh/wazuh/commit/cddf3fd16b0f945b28eb9c27714de3cc344e0926", "tags": ["x_refsource_MISC"], "url": "https://github.com/wazuh/wazuh/commit/cddf3fd16b0f945b28eb9c27714de3cc344e0926"}, {"name": "https://github.com/wazuh/wazuh/releases/tag/v4.14.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/wazuh/wazuh/releases/tag/v4.14.6"}, {"name": "https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2", "tags": ["x_refsource_MISC"], "url": "https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2"}], "affected": [{"vendor": "wazuh", "product": "wazuh", "versions": [{"version": ">= 4.4.0, < 4.14.6", "status": "affected"}, {"version": ">= 5.0.0-beta1, < 5.0.0-beta2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-19T16:21:49.920Z"}, "descriptions": [{"lang": "en", "value": "Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control characters. api/api/alogging.py interpolates that value into the plain-text API log. An unauthenticated attacker can include carriage returns or line feeds in the username to forge entries, obscure activity, or poison systems that consume the plain-text audit log. The JSON log format is not affected because JSON serialization escapes these characters. This issue is fixed in versions 4.14.6 and 5.0.0-beta2."}], "source": {"advisory": "GHSA-c3m6-fp2h-wmr4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-19T18:17:23.310124Z", "id": "CVE-2026-44256", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T18:18:11.834Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44256", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T18:17:23.310124Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T18:17:24.322Z"}}], "cna": {"title": "Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username", "source": {"advisory": "GHSA-c3m6-fp2h-wmr4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "wazuh", "product": "wazuh", "versions": [{"status": "affected", "version": ">= 4.4.0, < 4.14.6"}, {"status": "affected", "version": ">= 5.0.0-beta1, < 5.0.0-beta2"}]}], "references": [{"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-c3m6-fp2h-wmr4", "name": "https://github.com/wazuh/wazuh/security/advisories/GHSA-c3m6-fp2h-wmr4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/wazuh/wazuh/pull/35866", "name": "https://github.com/wazuh/wazuh/pull/35866", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wazuh/wazuh/commit/cddf3fd16b0f945b28eb9c27714de3cc344e0926", "name": "https://github.com/wazuh/wazuh/commit/cddf3fd16b0f945b28eb9c27714de3cc344e0926", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wazuh/wazuh/releases/tag/v4.14.6", "name": "https://github.com/wazuh/wazuh/releases/tag/v4.14.6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2", "name": "https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control characters. api/api/alogging.py interpolates that value into the plain-text API log. An unauthenticated attacker can include carriage returns or line feeds in the username to forge entries, obscure activity, or poison systems that consume the plain-text audit log. The JSON log format is not affected because JSON serialization escapes these characters. This issue is fixed in versions 4.14.6 and 5.0.0-beta2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-117", "description": "CWE-117: Improper Output Neutralization for Logs"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-19T16:21:49.920Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44256", "state": "PUBLISHED", "dateUpdated": "2026-08-19T18:18:11.834Z", "dateReserved": "2026-05-05T16:33:55.844Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-19T16:21:49.920Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "wazuh", "vendor": "wazuh", "versions": [{"status": "affected", "version": ">= 4.4.0, < 4.14.6"}, {"status": "affected", "version": ">= 5.0.0-beta1, < 5.0.0-beta2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*", "matchCriteriaId": "D543FB80-4465-4A81-94EA-22BF728B8EAF", "versionEndExcluding": "4.14.6", "versionStartIncluding": "4.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wazuh:wazuh:5.0.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "007B01AA-AED0-4E92-8999-07E74B630460", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control characters. api/api/alogging.py interpolates that value into the plain-text API log. An unauthenticated attacker can include carriage returns or line feeds in the username to forge entries, obscure activity, or poison systems that consume the plain-text audit log. The JSON log format is not affected because JSON serialization escapes these characters. This issue is fixed in versions 4.14.6 and 5.0.0-beta2."}, {"lang": "es", "value": "Wazuh es una plataforma de c\u00f3digo abierto y gratuita utilizada para la prevenci\u00f3n, detecci\u00f3n y respuesta ante amenazas. Desde la versi\u00f3n 4.4.0 hasta la 4.14.6 y la 5.0.0-beta2, api/api/middlewares.py decodifica el nombre de usuario de la autenticaci\u00f3n Basic antes de la validaci\u00f3n de credenciales y lo pasa al registrador de acceso sin neutralizar los caracteres de control. api/api/alogging.py interpola ese valor en el registro de la API en texto plano. Un atacante no autenticado puede incluir retornos de carro o saltos de l\u00ednea en el nombre de usuario para falsificar entradas, oscurecer la actividad o envenenar sistemas que consumen el registro de auditor\u00eda en texto plano. El formato de registro JSON no se ve afectado porque la serializaci\u00f3n JSON escapa estos caracteres. Este problema se ha solucionado en las versiones 4.14.6 y 5.0.0-beta2."}], "id": "CVE-2026-44256", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44256", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-19T18:17:23.310124Z", "version": "2.0.3"}}]}, "published": "2026-08-19T17:18:48.930", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/wazuh/wazuh/commit/cddf3fd16b0f945b28eb9c27714de3cc344e0926"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/wazuh/wazuh/pull/35866"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/wazuh/wazuh/releases/tag/v4.14.6"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-c3m6-fp2h-wmr4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-117"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.4.0,4.14.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0-beta1,5.0.0-beta2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "wazuh", "source": "cna", "vendor": "wazuh"}, "product": "wazuh", "vendor": "wazuh"}], "created": "2026-08-19T18:30:03.415397+00:00", "updated": "2026-08-20T14:00:04.398264+00:00", "vendors": ["wazuh", "wazuh$PRODUCT$wazuh"]}