HIGH 8.8 NVD
CVE-2026-112340
Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager
Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace the server-side session Bearer token, letting them act as another Manager API identity or send unauthenticated upstream requests.
References
- https://github.com/wazuh/wazuh/releases/tag/v4.14.9
- https://github.com/wazuh/wazuh/security/advisories/GHSA-7rvv-9467-96mc
- https://www.vulncheck.com/advisories/wazuh-4.9.0-before-4.14.9-authorization-header-overri
- https://github.com/wazuh/wazuh/security/advisories/GHSA-7rvv-9467-96mc
This high severity vulnerability with a CVSS score of 8.8 was published on 2026-11-06 via NVD.
vulnfeed aggregates 16326 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.