Read the docs
TI-2026-85945 Aliases CVE-2026-112340

Authorization header override in Wazuh dashboard plugins

Priority HIGH 73CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an incorrect authorization flaw (CWE-863) in the /api/request proxy endpoint. An authenticated dashboard user can override the Manager API Authorization header by supplying a nested body.headers.Authorization value, which replaces the server-side session Bearer token. This lets the user act as another Manager API identity or send unauthenticated upstream requests, with high confidentiality and integrity impact.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace the server-side session Bearer token, letting them act as another Manager API identity or send unauthenticated upstream requests.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00346 28th percentileScored 2026-11-07
Fix Fixed wazuh-dashboard-plugins (wazuh): 4.14.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Wazuhwazuh-dashboard-plugins4.9.0 to before 4.14.94.14.9Patch availableCNA
  • wazuh-dashboard-plugins VendorWazuh Affected 4.9.0 to before 4.14.9 Fixed in 4.14.9 Patch available CNA

Remediation

Upgrade wazuh-dashboard-plugins to version 4.14.9 or later, which fixes the issue. The sources list no fixed version for other branches.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA wazuh-dashboard-plugins (wazuh) Fixed in 4.14.9

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-112340
  2. 2026-11-06 CISA SSVC decision points changed
  3. 2026-11-06 Priority changed: MEDIUM → HIGH

References

Advisory 1

Other 1

  • TI-2025-17783 Remote code execution in Wazuh server KEVCVSS 3.1CRITICAL 9.9
  • TI-2026-47604 Wazuh GitHub Actions Shell Injection via Fork Pull Request CVSS 4.0CRITICAL 9.3
  • TI-2026-71739 Missing origin check in Wazuh manager allows arbitrary file read CVSS 4.0HIGH 8.7
  • TI-2026-71743 Arbitrary file overwrite in Wazuh manager enables root code execution CVSS 4.0CRITICAL 9.4
  • TI-2026-23722 Path traversal in wazuh CVSS 3.1CRITICAL 9.9
  • TI-2024-01157 Remote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theft CVSS 4.0CRITICAL 9.5
See all 101 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences