CVE-2026-74041

Wazuh 4.14.3-4.14.7 allows authenticated users with manager:update_config to inject uppercase LOG_FORMAT commands that execute as root due to a case-sensitivity bypass in the ossec.conf validator.

An authenticated user with manager:update_config can inject an uppercase LOG_FORMAT command into the localfile directive, which the wazuh-logcollector executes as root upon reload. This bypasses remote-command validation and grants root-level command execution, directly violating NIST 800-171 requirements for preventing unauthorized access and ensuring system integrity. DIB organizations must ensure Wazuh is patched to 4.14.8 or higher and restrict manager:update_config privileges.

Shame score — A case-sensitivity bypass allowing root command execution from a privileged role demonstrates a fundamental flaw in input validation that could have been caught with basic testing.