Key points
- Wazuh versions 4.14.3 to 4.14.7 contain a case-sensitivity mismatch in configuration validation.
- Authenticated users with manager:update_config rights can inject uppercase LOG_FORMAT commands.
- The wazuh-logcollector executes these commands as root upon reloading its configuration.
An attacker who gains access to a Wazuh manager account can now execute commands with root privileges on connected agents. This occurs because the system fails to consistently check the case of configuration entries. The flaw affects Wazuh versions 4.14.3 through 4.14.7. Security researchers have rated the vulnerability critical with a CVSS score of 9.4. The issue stems from a mismatch between the validator and the collector components.
In plain English
The Wazuh security platform uses a configuration file called ossec.conf to manage settings. A validator checks these settings for safety before they are applied. However, the component that actually runs the settings, wazuh-logcollector, processes them differently. It treats uppercase and lowercase letters as distinct. This discrepancy allows a malicious entry to pass the safety check while still being executed by the system. The result is a bypass of remote-command validation controls.
The background
According to the National Vulnerability Database, the weakness is classified under CWE-178. This category covers improper handling of case sensitivity. The specific vulnerability is identified as CVE-2026-74041. It affects Wazuh wazuh-manager installations prior to version 4.14.8. The flaw allows an authenticated user with the manager:update_config permission to exploit the system. They can inject a localfile configuration using an uppercase LOG_FORMAT command.
What changes now
Organisations using affected versions of Wazuh are exposed to this risk. The vulnerability enables command execution on the agent side. This happens when the collector reloads its configuration. The root-level execution occurs because the collector trusts the injected command. Users with the specific update configuration right can trigger this. The issue exists in versions 4.14.3, 4.14.4, 4.14.5, 4.14.6 and 4.14.7.
The attacker's path
Teams usually monitor for unusual configuration changes within their security information and event management platforms. In this scenario, an insider or compromised account leverages existing permissions to modify system settings. The technique relies on the system’s inconsistent handling of text casing. This allows malicious input to evade standard validation filters. Such flaws often serve as an initial foothold for privilege escalation. Analysts should review logs for unexpected reloads or format changes.
What to do and how to stay safe: Wazuh
- Verify your Wazuh manager version immediately to see if it falls within the affected range.
- Restrict the manager:update_config permission to only essential personnel until a fix is applied.
- Monitor agent logs for unexpected configuration reloads or unusual command executions.
- Plan to upgrade to Wazuh 4.14.8 or later once the vendor releases the update.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Wazuh versions are affected by this vulnerability?
Wazuh versions 4.14.3 through 4.14.7 are affected by this case-sensitivity mismatch.
What permission does an attacker need to exploit this flaw?
The attacker needs an authenticated account with the manager:update_config permission.
Is there a confirmed fix for CVE-2026-74041?
The source material indicates that versions before 4.14.8 are affected, implying 4.14.8 resolves it.
