CVE-2026-74041

Executive Summary

CVE-2026-74041 is a case-sensitivity validation bypass (CWE-178) in Wazuh versions 4.14.3 through 4.14.7, in which a mismatch between the ossec.conf configuration validator and the wazuh-logcollector component allows an authenticated user holding the manager:update_config permission to inject a LOG_FORMAT command directive written in uppercase. The configuration validator fails to recognize the uppercase variant as a restricted command, while wazuh-logcollector processes it case-insensitively and executes the embedded command as root upon configuration reload. With a CVSS v3.1 base score of 9.1, this vulnerability enables a privileged low-level authenticated attacker to achieve full root-level command execution on the Wazuh manager host, resulting in complete compromise of confidentiality, integrity, and availability.

Technical Analysis

The vulnerability resides at the intersection of two Wazuh subsystems: the configuration validator that parses and screens ossec.conf, and the wazuh-logcollector daemon that reads localfile blocks from that same configuration and acts on them. Wazuh's localfile configuration blocks permit the definition of LOG_FORMAT entries that specify how log data is collected. Certain command-style arguments within these blocks are meant to be rejected by the validator under normal privilege assumptions, because executing embedded commands as the Wazuh manager grants root-equivalent control of the host.

The flaw is a canonicalization inconsistency — the CWE-178 class, "Improper Handling of Case Sensitivity." The validator applies a case-sensitive comparison when deciding whether a supplied LOG_FORMAT value refers to a restricted command directive. Consequently, a value submitted in uppercase (for example, an uppercased variant of the command directive keyword) does not match the validator's deny rule and passes inspection. The wazuh-logcollector, however, does not perform a case-sensitive normalization of the same field and treats the uppercase directive as semantically equivalent to the canonical lowercase form. Because the two components disagree on what constitutes a restricted token, the validation gate that is supposed to protect the manager is effectively bypassed.

The net effect is a confused-deputy condition: the configuration validator is bypassed, and wazuh-logcollector, running as root, becomes the execution agent for attacker-influenced input. The execution is triggered "on reload" — that is, when the Wazuh manager reloads its configuration and reinitializes wazuh-logcollector, the malicious uppercase command localfile is parsed and run with the privileges of the collector process, which is root.

The attack surface is the Wazuh manager configuration API, reachable remotely over the network. The CVSS vector reflects this accurately: AV:N (network attack vector), AC:L (no unusual preconditions for exploitation beyond authenticated access), PR:H (requires the high-privilege manager:update_config permission), UI:N (no user interaction required), and S:C (scope changed — the impact propagates from the configuration subsystem into the underlying host operating system context). Impact subscores are C:H/I:H/A:H, reflecting total root-level compromise. The CNA description provides no function names, method signatures, or exact file paths beyond the two component identifiers (ossec.conf and wazuh-logcollector) and the LOG_FORMAT directive. No public proof-of-concept, exploit code, or Nuclei template is available; the exploit mechanics are therefore derived from the vulnerability class and the CNA narrative only.

Exploitation Scenarios

Because no public proof-of-concept exists, the following attack chain is reconstructed strictly from the CNA description and the CWE-178 vulnerability class. It should be treated as a class-level model, not a verified weaponization sequence.

1. Reconnaissance and access acquisition. The attacker must already hold an authenticated manager account configured with the manager:update_config permission. This is a high-privilege configuration-management capability, typically granted to Wazuh administrators or integrated management tooling. The attacker may obtain this through credential compromise, an over-permissioned service account, a compromised management integration, or insider access. Reconnaissance involves identifying a reachable Wazuh manager (default API port 55000, agent traffic on 1514, manager dashboard exposure) and confirming the manager version falls within the 4.14.3 to 4.14.7 range.

2. Triggering the flaw. Using the manager:update_config capability, the attacker submits a configuration change that defines a localfile entry containing a LOG_FORMAT command directive written in uppercase. Because the ossec.conf validator compares the field case-sensitively against its restricted-command rules, the uppercase directive evades detection while the lowercase form would have been rejected. This is the core of the CWE-178 case-sensitivity mismatch.

3. Execution. The malicious configuration is persisted into ossec.conf and the Wazuh manager is reloaded. On reload, wazuh-logcollector re-parses the localfile blocks; because the collector treats the uppercase directive as equivalent to the command form, it executes the embedded command as root. No further interaction from the original authenticated session is required at this stage.

4. Post-exploitation impact. Successful command execution as root on the Wazuh manager yields total control of the host. Because Wazuh managers frequently serve as centralized security-monitoring infrastructure, an attacker can disable or tamper with detection and alerting, exfiltrate collected security telemetry and credentials, pivot to managed agents, deploy persistence, and potentially move laterally across the monitored estate. The scope change (S:C) explicitly models the escape from the configuration subsystem into full host compromise.

Impact Assessment

The business impact is severe. Wazuh is a widely deployed open-source SIEM and XDR platform; compromise of a Wazuh manager undermines the security monitoring capability for an entire monitored fleet, not just a single endpoint. An attacker with root on the manager can silence alerts, alter or delete collected logs, steal agent keys and credentials, and use the manager's trust relationships with agents as a pivot point. Because the manager centralizes telemetry from many hosts, the blast radius extends to every agent and every environment the manager observes.

The CVSS v3.1 base score of 9.1 (Critical) is consistent with the impact: AV:N means the manager configuration API is reachable over the network; PR:H reflects that a valid manager:update_config principal is required; AC:L indicates no special exploitation conditions beyond that access; and UI:N means no victim interaction is needed. The S:C scope change is particularly significant because it captures that the vulnerability's impact crosses a security boundary from the Wazuh configuration plane into the host operating system, where the attacker operates as root. Confidentiality, integrity, and availability impacts are all High, meaning the attacker can read any data on the manager, modify any configuration or data, and render the manager unavailable.

Detection Guidance

Detection should focus on (a) configuration changes that introduce LOG_FORMAT command directives with abnormal casing in localfile blocks, (b) manager configuration reload events that follow such changes, and (c) process execution originating from the Wazuh manager root context immediately after a reload. Defenders should monitor the Wazuh API audit trail for manager:update_config calls and alert on any localfile LOG_FORMAT value containing command-style directives in uppercase or mixed case.

Sigma Rule

title: Wazuh Case-Sensitivity Bypass Leading to Root Command Execution
id: 3f6a9c1e-74041-4b8a-9c1e-wazuh0cve
status: experimental
description: Detects modification of Wazuh ossec.conf containing an uppercase LOG_FORMAT command directive, exploiting CVE-2026-74041 case-sensitivity validation bypass in wazuh-logcollector.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-74041
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1059
  - attack.defense_evasion
logsource:
  product: linux
  service: file_event
detection:
  selection_target:
    TargetFilename|endswith: '/etc/ossec.conf'
  selection_content:
    - LOG_FORMAT|contains: 'CMD'
    - LOG_FORMAT|contains: 'command'
    - 'LOG_FORMAT'
  condition: selection_target and selection_content
fields:
  - TargetFilename
  - User
falsepositives:
  - Legitimate administrative configuration changes
level: high

YARA Rule

rule CVE_2026_74041_Wazuh_Uppercase_LOGFORMAT
{
    meta:
        description = "Detects uppercase LOG_FORMAT command directives in Wazuh ossec.conf exploitation of CVE-2026-74041"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-74041"
        date = "2026-01-01"
        severity = "high"
    strings:
        $localfile = "localfile" nocase
        $logformat = "LOG_FORMAT" nocase
        $ossec = "ossec.conf" nocase
    condition:
        $logformat and $localfile
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-74041 Wazuh Manager Config Update Injection Attempt"; flow:to_server,established; http.method; content:"PUT"; http.uri; content:"/manager"; content:"LOG_FORMAT"; nocase; content:"localfile"; nocase; classtype:attempted-admin; reference:cve,2026-74041; sid:202674041; rev:1;)

Elastic Detection

process where event.type == "start" and process.parent.name == "wazuh-logcollector" and process.parent.user.name == "root"

Splunk SPL Query

index=wazuh OR index=ossec sourcetype=wazuh:api OR sourcetype=ossec:manager
| search "manager:update_config" OR "LOG_FORMAT" OR "localfile"
| where match(_raw, "(?i)LOG_FORMAT") AND match(_raw, "[A-Z]{2,}")
| table _time host user action result
| sort - _time

Wazuh OSSEC Rule

<group name="wazuh_config_integrity,">
  <rule id="100740" level="12">
    <decoded_as>ossec</decoded_as>
    <match>LOG_FORMAT</match>
    <match>localfile</match>
    <description>CVE-2026-74041: Potential case-sensitivity bypass via uppercase LOG_FORMAT directive in ossec.conf localfile</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>config_change,defense_evasion,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict the manager:update_config permission to the smallest possible set of trusted administrators and eliminate its assignment to automation service accounts where feasible. Enforce strong authentication (MFA, certificate-based auth) and network-level access controls on the Wazuh manager API (default port 55000) so it is not reachable from untrusted networks. Enable file integrity monitoring on ossec.conf and alert on any localfile LOG_FORMAT entries containing command-style directives. If operationally viable, manually review and reject configuration submissions that include uppercase variants of restricted directive keywords.

2. Patch/upgrade steps. The CNA description states the vulnerability affects Wazuh "4.14.3 before 4.14.8," which strongly implies remediation via upgrade to version 4.14.8 or later. This must be independently verified against the vendor's official security advisories and release notes, as no patch source was tracked (patch confidence 0/4). Until a vendor advisory confirms the fix, treat 4.14.3 through 4.14.7 as vulnerable and do not assume an upgrade resolves the issue without validation. Monitor the Wazuh project's security advisory channel and GitHub releases for an authoritative fix reference.

3. Long-term hardening. Implement defense-in-depth: run Wazuh components under least-privilege service accounts where the architecture permits, avoiding scenarios where the log collector executes attacker-influenced input as root. Apply strict allowlist validation and canonicalization (case-folding) for all configuration directives across every parsing component, and centralize case-normalization logic to avoid validator/consumer mismatches. Adopt configuration-as-code with peer review and automated policy checks. Continuously audit for privilege-escalation paths that stem from configuration-driven execution, and include Wazuh manager configuration review in regular security assessments.

References

• NVD — CVE-2026-74041: https://nvd.nist.gov/vuln/detail/CVE-2026-74041
• Wazuh official project security advisories: https://wazuh.com/ (verify latest advisory and release notes)
• Wazuh GitHub repository and release notes: https://github.com/wazuh/wazuh
• CWE-178 — Improper Handling of Case Sensitivity: https://cwe.mitre.org/data/definitions/178.html
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-74041 not listed at time of writing)

No public proof-of-concept, exploit code, Nuclei template, or in-the-wild exploitation evidence was identified at the time of this report. No threat actor campaigns have been associated with this CVE in the provided data.