Wazuh Dashboard: Authorization bypass in /api/request proxy (CVE-2026-112340)

Wazuh dashboard plugins in versions 4.9.0 through 4.14.8 contain an authorization bypass vulnerability (CVE-2026-112340) in the /api/request proxy endpoint. An authenticated user can supply a nested body.headers.Authorization value within a request, causing the dashboard to overwrite the server-side session Bearer token. This allows the attacker to impersonate other Manager API identities or submit unauthenticated requests to the backend API.

Impact

Successful exploitation allows an authenticated user to perform unauthorized actions with the privileges of another user or unauthenticated service account within the Wazuh Manager API, potentially leading to unauthorized system configuration changes or data access.

Recommendation

• Upgrade the Wazuh dashboard to version 4.14.9 or later to remediate CVE-2026-112340.
• Audit logs for the /api/request endpoint to identify potential abuse of the authorization header modification.
• Implement strict access controls for dashboard users to limit the potential impact of authenticated privilege escalation.