CVE-2026-74041 in wazuh-manager
Summary
by MITRE • 10/13/2026
Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Wazuh versions prior to 4.14.8 stems from a critical case-sensitivity mismatch within the configuration management subsystem, specifically affecting the interaction between the ossec.conf validator and the wazuh-logcollector component. This architectural flaw creates a security gap where input validation logic fails to normalize or strictly enforce command casing during the parsing of local file configurations. The core issue lies in how the system distinguishes between legitimate log collection directives and potentially malicious commands, allowing an attacker to exploit this inconsistency to bypass established remote-command validation mechanisms.
Authenticated users possessing manager:update_config privileges can leverage this flaw by injecting a specially crafted configuration entry into the ossec.conf file. By specifying a localfile directive with an uppercase LOG_FORMAT command string, the user triggers a state where the validator accepts the input as valid because it does not strictly match the expected lowercase syntax during its initial check. However, when the wazuh-logcollector service reloads to apply these configuration changes, it processes the entry differently due to internal parsing logic that treats the uppercase variant as an executable command rather than a static log format definition.
This discrepancy results in arbitrary code execution with root privileges on the managed endpoint. Since the wazuh-logcollector daemon typically operates under elevated permissions to access sensitive system logs, successfully injecting and executing this malformed directive allows an attacker to run commands directly within the context of the root user. This represents a severe escalation of privilege from a standard authenticated configuration manager role to full administrative control over the host system, enabling further lateral movement or data exfiltration.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-78 OS Command Injection. The failure to enforce consistent case sensitivity during input processing constitutes an improper validation error that leads directly to command injection. In the context of the MITRE ATT&CK framework, this behavior maps to T1546.003 Event Triggered Execution: Windows or Linux Service Triggers and potentially T1059 Command and Scripting Interpreter, as it involves executing system commands through a trusted service via manipulated configuration files.
Mitigation strategies must prioritize immediate patching of the Wazuh agent and manager components to version 4.14.8 or later, where this case-sensitivity logic has been corrected to enforce strict lowercase validation for log format directives. Additionally, organizations should implement principle of least privilege by restricting manager:update_config permissions to only those administrators who strictly require it, thereby reducing the attack surface. Regular auditing of configuration files and monitoring for unexpected service reloads can also help detect potential exploitation attempts before they result in full system compromise.