{"id":"CVE-2026-74041","published":"2026-10-13T14:17:40.860","lastModified":"2026-10-14T16:14:23.840","description":"Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-178"],"vendors":[],"products":[],"references":[{"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.8","tags":[]},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-cjf8-wjx6-hjw6","tags":[]},{"url":"https://www.vulncheck.com/advisories/wazuh-4.14.3-before-4.14.8-remote-command-validation-bypass-via-case-mismatch","tags":[]},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-cjf8-wjx6-hjw6","tags":[]}],"exploitRefs":[{"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.8","tags":[]},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-cjf8-wjx6-hjw6","tags":[]},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-cjf8-wjx6-hjw6","tags":[]}],"hasPoc":true,"ai":{"summary":"A case-sensitivity bug in Wazuh's configuration validation allows authenticated users with manager:update_config privileges to inject uppercase LOG_FORMAT commands that bypass validation and execute as root during log collector reload. This creates a privilege escalation vector where attackers can run arbitrary commands with root privileges.","exploitability":"Exploitation requires an authenticated user with manager:update_config permissions, which is moderately difficult but achievable in environments where users have administrative access, and the attack must be timed around configuration reloads.","blast_radius":"The impact is critical as attackers can execute arbitrary commands as root on any Wazuh manager node, potentially leading to full system compromise and lateral movement across the monitored infrastructure.","remediation":"Upgrade to Wazuh 4.14.8 or later to fix the case-sensitivity mismatch in configuration validation.","detection":"Monitor for unusual configuration changes in ossec.conf that include uppercase LOG_FORMAT directives, particularly when followed by immediate log collector restarts or reloads, and look for root process execution patterns during configuration updates.","tags":["privilege-escalation","config-injection","wazuh","log-collector"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:56:07.861Z"}}