{"id":"CVE-2026-54085","summary":"Wazuh: Missing input validation in multiple active response scripts allows argument injection","details":"Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, allowing argument injection into tools that run as root. Five of the eight scripts that handle the srcip field, route-null.c, netsh.c, pf.c, npf.c, and ipfw.c, omit the get_ip_version() check that rejects non-IP input, and disable-account.c passes the dstuser field to passwd/chuser with only a comparison against \"root\". An attacker who can inject crafted log events, for example via syslog, can supply srcip or dstuser values that, when an active response rule triggers, are passed unvalidated to firewall and account-management commands such as pfctl, npfctl, ipfw, route, netsh, and passwd. This enables injecting additional command arguments, and on Windows the unquoted CreateProcess command-line concatenation in wpopenv() lets a srcip containing spaces add further arguments, while disable-account.c can be abused to lock arbitrary system accounts. This issue is fixed in version 4.14.7.","aliases":["GHSA-mvh4-g699-984j"],"modified":"2026-11-11T13:30:23.937731006Z","published":"2026-08-27T22:55:18.883Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-88"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54085.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54085.json"},{"type":"ADVISORY","url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-mvh4-g699-984j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54085"},{"type":"FIX","url":"https://github.com/wazuh/wazuh/commit/b7f3a5e59000e4cdef75f397f1107ae3e1c186a9"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wazuh/wazuh","events":[{"introduced":"b197e669827fc72de31b566636e7b9b74585765f"},{"fixed":"a42268a27c555d9348d5598fb8751eaf4c8e9024"},{"fixed":"b7f3a5e59000e4cdef75f397f1107ae3e1c186a9"}],"database_specific":{"extracted_events":[{"source":"CPE_RANGE","cpe":"cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*","range":[{"introduced":"4.2.0"},{"fixed":"4.14.7"}]},{"range":[{"fixed":"b7f3a5e59000e4cdef75f397f1107ae3e1c186a9"}],"source":"REFERENCES_COMMIT"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54085.json","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/wazuh/wazuh/commit/b7f3a5e59000e4cdef75f397f1107ae3e1c186a9","target":{"file":"src/active-response/firewalls/default-firewall-drop.c","function":"main"},"deprecated":false,"digest":{"function_hash":"273429095714245913177502339853817355162","length":7760},"id":"CVE-2026-54085-2172623a"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/wazuh/wazuh/commit/b7f3a5e59000e4cdef75f397f1107ae3e1c186a9","target":{"file":"src/active-response/active_responses.h"},"deprecated":false,"digest":{"line_hashes":["265595495477657373499893173497398186345","206037566350875058291998974696714375761","67550230525597845453666360033915567180","260934214555034768677119807230112050505","304413033414088174886656407172442725773","296498218131136746696027139863879385413","208820658583404144158996220778638315971","293217536487012725411804239552710435752","158356840969383838490465095862665308302","296525256914329473742124495494994114374"],"threshold":0.9},"id":"CVE-2026-54085-2ceda64e"},{"source":"https://github.com/wazuh/wazuh/commit/b7f3a5e59000e4cdef75f397f1107ae3e1c186a9","target":{"file":"src/active-response/disable-account.c"},"deprecated":false,"digest":{"line_hashes":["316047364902004172857249399736847409477","141524773705757584461055094897395745928","24260019859171369161230077503902304134","58842823471929433129225013416994133021","216097438268349209885725972651968763440","151344667765250906169612261396853078060","250661136961965552842240121347399040894","260606980494695094452646386873857547977","28805811572898393243968735747241934780","186958327730877901486851643206256921530","129727296142208197876128208543971587503","123246973414696271206614086033687737849","149857211193866212647125736971924834810","181368154782165203389939693454662318314"],"threshold":0.9},"id":"CVE-2026-54085-307dc751","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-54085-35b56e3b","signature_type":"Function","signature_version":"v1","source":"https://github.com/wazuh/wazuh/commit/b7f3a5e59000e4cdef75f397f1107ae3e1c186a9","target":{"file":"src/active-response/active_responses.c","function":"get_username_from_json"},"deprecated":false,"digest":{"function_hash":"96505359921306101864241874761522425958","length":484}},{"target":{"file":"src/active-response/firewalls/default-firewall-drop.c"},"deprecated":false,"digest":{"line_hashes":["121478710007477136799738414265479916296","293920281374922724450008185174689326346","330026563605731911830221020117311368047","94205368358430127140497441049093516607","310404202555591034017757975680388897926","280683445487626218754400229456597612442"],"threshold":0.9},"id":"CVE-2026-54085-3ac0ec98","signature_type":"Line","signature_version":"v1","source":"https://github.com/wazuh/wazuh/commit/b7f3a5e59000e4cdef75f397f1107ae3e1c186a9"},{"id":"CVE-2026-54085-53277404","signature_type":"Line","signature_version":"v1","source":"https://github.com/wazuh/wazuh/commit/b7f3a5e59000e4cdef75f397f1107ae3e1c186a9","target":{"file":"src/active-response/ip-customblock.c"},"deprecated":false,"digest":{"line_hashes":["121478710007477136799738414265479916296","293920281374922724450008185174689326346","330026563605731911830221020117311368047","94205368358430127140497441049093516607","310404202555591034017757975680388897926","280683445487626218754400229456597612442","103669228787330502303629639823824883786","281907947950484149733080137647664106941","107719403435992961979333248582417130039","121754599531206172898525492199267529110","191195968520917496579774416887191620139","12137383764642589129240139159439214460","56699535744126551001936901766763596558"],"threshold":0.9}},{"digest":{"line_hashes":["121478710007477136799738414265479916296","293920281374922724450008185174689326346","330026563605731911830221020117311368047","94205368358430127140497441049093516607","310404202555591034017757975680388897926","280683445487626218754400229456597612442","162714304954370403062596604222108418462","325528838655300660101069108861806514609","107719403435992961979333248582417130039","121754599531206172898525492199267529110","191195968520917496579774416887191620139","12137383764642589129240139159439214460","56699535744126551001936901766763596558","336096278108583183651521149574624479053","302750517882725365457575231240127280180","275897297958702013953171870195452214436"],"threshold":0.9},"id":"CVE-2026-54085-57fff64a","signature_type":"Line","signature_version":"v1","source":"https://github.com/wazuh/wazuh/commit/b7f3a5e59000e4cdef75f397f1107ae3e1c186a9","target":{"file":"src/active-response/host-deny.c"},"deprecated":false},{"id":"CVE-2026-54085-63f61c47","signature_type":"Function","signature_version":"v1","source":"https://github.com/wazuh/wazuh/commit/b7f3a5e59000e4cdef75f397f1107ae3e1c186a9","target":{"file":"src/active-response/disable-account.c","function":"main"},"deprecated":false,"digest":{"function_hash":"324309871841925690645402211270335389226","length":2832}},{"id":"CVE-2026-54085-979037f5","signature_type":"Function","signature_version":"v1","source":"https://github.com/wazuh/wazuh/commit/b7f3a5e59000e4cdef75f397f1107ae3e1c186a9","target":{"file":"src/active-response/active_responses.c","function":"get_ip_version"},"deprecated":false,"digest":{"length":473,"function_hash":"21736584894496193937881076088675421542"}},{"source":"https://github.com/wazuh/wazuh/commit/b7f3a5e59000e4cdef75f397f1107ae3e1c186a9","target":{"function":"main","file":"src/active-response/ip-customblock.c"},"deprecated":false,"digest":{"function_hash":"248545890565627729541408036168545241519","length":2020},"id":"CVE-2026-54085-ab536ef0","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/wazuh/wazuh/commit/b7f3a5e59000e4cdef75f397f1107ae3e1c186a9","target":{"file":"src/active-response/host-deny.c","function":"main"},"deprecated":false,"digest":{"function_hash":"307998994963681017292080918894530693693","length":5234},"id":"CVE-2026-54085-b32e1b58","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/active-response/active_responses.c","function":"get_srcip_from_json"},"deprecated":false,"digest":{"function_hash":"240590553913429461056855472130118299417","length":563},"id":"CVE-2026-54085-b5437ef5","signature_type":"Function","signature_version":"v1","source":"https://github.com/wazuh/wazuh/commit/b7f3a5e59000e4cdef75f397f1107ae3e1c186a9"},{"id":"CVE-2026-54085-b7d19d83","signature_type":"Function","signature_version":"v1","source":"https://github.com/wazuh/wazuh/commit/b7f3a5e59000e4cdef75f397f1107ae3e1c186a9","target":{"function":"main","file":"src/active-response/firewalld-drop.c"},"deprecated":false,"digest":{"function_hash":"59145054347549983063885083272032923483","length":3346}},{"id":"CVE-2026-54085-c2308427","signature_type":"Line","signature_version":"v1","source":"https://github.com/wazuh/wazuh/commit/b7f3a5e59000e4cdef75f397f1107ae3e1c186a9","target":{"file":"src/active-response/firewalld-drop.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["121478710007477136799738414265479916296","293920281374922724450008185174689326346","330026563605731911830221020117311368047","94205368358430127140497441049093516607","310404202555591034017757975680388897926","280683445487626218754400229456597612442"]}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/wazuh/wazuh/commit/b7f3a5e59000e4cdef75f397f1107ae3e1c186a9","target":{"file":"src/active-response/active_responses.c"},"deprecated":false,"digest":{"line_hashes":["211379481851861872476793121495875998157","186401355848295311761765835822969763695","247200544787329224081038655825663916698","182836954651790388689280029583359013035","333240100556570778278680879783381368139","303244289170376872534121787039729910918","153738728746738144447604566634430218566","209732600608177256699855032708965941222","3680234581846674685391557473365499546","290691924918895541721349077969002803072","196451178127123130760828984896673751971","198308457477508208072430743710265263252","101988719061717366122787762583072242600","318680116284754319142972631250711948093","226940785017293330407257725157250810000","138903156642306604149957410991319494817","244824329864804957160419320308209030726","167509693918585542071804559696333723584","184176806852597904999167426085782550343","250617908023498612398322584301431336661","77398276674313163388949996183323238221","284843743142543603370295121910703157077","271511566517049668446498130870352795784","196823948114854045455559613773012931248","293197097489703626510713394822910278723","223870798496522353428826329058452407706","332634143259653218551367884575399690740","95043172428377561798287950940221633802","148006839761824908815340504393592254680","83940315817055544351891849445118540267","91374978554058580127914985616023279492","12352867071958975992092281330837246650","104579222667209717982357965944856320419","240635058463948573666104574966388089231","230583490991756618138114669179729629507","323267518920838838453849396051282388649","324372161021148946610963545198016863188","226636235445221190935666889492826081946","79715383032446560173611342418704777110","93671383007875513834628290207445063613"],"threshold":0.9},"id":"CVE-2026-54085-f50868de"}],"vanir_signatures_modified":"2026-11-11T13:30:23Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"}]}