CVE-2026-54085

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.2.0 through 4.14.6

Description Multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, enabling argument injection into tools running as root. Specifically, five scripts handling the srcip field—route-null.c, netsh.c, pf.c, npf.c, and ipfw.c—fail to use the get ip version() check to reject non-IP input. Additionally, disable-account.c passes the dstuser field to passwd/chuser with only a basic comparison against "root". An attacker can inject crafted log events, such as via syslog, to supply malicious srcip or dstuser values. When an active response rule triggers, these values are passed unvalidated to commands including pfctl, npfctl, ipfw, route, netsh, and passwd. On Windows, unquoted command-line concatenation in the wpopenv() function allows a srcip containing spaces to add further arguments, while disable-account.c can be used to lock arbitrary system accounts.

Recommendations Update to version 4.14.7. As a temporary mitigation, restrict the ability to inject crafted log events via syslog or other input sources that trigger active response rules.