Wazuh up to 4.14.6 Active Response route-null.c wpopenv srcip/dstuser argument injection

Summaryinfo

A vulnerability was found in Wazuh up to 4.14.6. It has been classified as problematic. This affects the function wpopenv of the file route-null.c of the component Active Response. This manipulation of the argument srcip/dstuser causes argument injection. This vulnerability is registered as CVE-2026-54085. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability classified as problematic was found in Wazuh up to 4.14.6. Affected by this vulnerability is the function wpopenv of the file route-null.c of the component Active Response. The manipulation of the argument srcip/dstuser with an unknown input leads to a argument injection vulnerability. The CWE definition for the vulnerability is CWE-88. The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. As an impact it is known to affect integrity, and availability. The summary by CVE is:

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, allowing argument injection into tools that run as root. Five of the eight scripts that handle the srcip field, route-null.c, netsh.c, pf.c, npf.c, and ipfw.c, omit the get_ip_version() check that rejects non-IP input, and disable-account.c passes the dstuser field to passwd/chuser with only a comparison against "root". An attacker who can inject crafted log events, for example via syslog, can supply srcip or dstuser values that, when an active response rule triggers, are passed unvalidated to firewall and account-management commands such as pfctl, npfctl, ipfw, route, netsh, and passwd. This enables injecting additional command arguments, and on Windows the unquoted CreateProcess command-line concatenation in wpopenv() lets a srcip containing spaces add further arguments, while disable-account.c can be abused to lock arbitrary system accounts. This issue is fixed in version 4.14.7.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-54085 since 06/11/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

Upgrading to version 4.14.7 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Wazuh

Version

• 4.14.0
• 4.14.1
• 4.14.2
• 4.14.3
• 4.14.4
• 4.14.5
• 4.14.6

Website

• Product: https://github.com/wazuh/wazuh/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion