CVE-2026-44256

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.4.0 through 4.14.5 Wazuh versions 5.0.0-beta1 and earlier

Description An issue exists where the api/api/middlewares.py component decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control characters. Subsequently, api/api/alogging.py interpolates this value into the plain-text API log. An unauthenticated attacker can inject carriage returns or line feeds into the username to forge log entries, hide malicious activity, or poison systems that process the plain-text audit log. This issue does not affect the JSON log format due to JSON serialization escaping these characters.

Recommendations Update to version 4.14.6. Update to version 5.0.0-beta2.