CVE-2026-54085

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-54085

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54085.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-54085

Aliases

GHSA-mvh4-g699-984j

Published

2026-08-27T22:55:18.883Z

Modified

2026-08-29T03:46:18.749778695Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L CVSS Calculator

Summary

Wazuh: Missing input validation in multiple active response scripts allows argument injection

Details

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, allowing argument injection into tools that run as root. Five of the eight scripts that handle the srcip field, route-null.c, netsh.c, pf.c, npf.c, and ipfw.c, omit the getipversion() check that rejects non-IP input, and disable-account.c passes the dstuser field to passwd/chuser with only a comparison against "root". An attacker who can inject crafted log events, for example via syslog, can supply srcip or dstuser values that, when an active response rule triggers, are passed unvalidated to firewall and account-management commands such as pfctl, npfctl, ipfw, route, netsh, and passwd. This enables injecting additional command arguments, and on Windows the unquoted CreateProcess command-line concatenation in wpopenv() lets a srcip containing spaces add further arguments, while disable-account.c can be abused to lock arbitrary system accounts. This issue is fixed in version 4.14.7.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54085.json",
    "cwe_ids": [
        "CWE-88"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/wazuh/wazuh

Affected ranges

Type

GIT

Repo

https://github.com/wazuh/wazuh

Events

Introduced

b197e669827fc72de31b566636e7b9b74585765f

Fixed

a42268a27c555d9348d5598fb8751eaf4c8e9024

Database specific

Show details

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "4.2.0"
        },
        {
            "fixed": "4.14.7"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54085.json"