{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awazuhwazuh_dashboard/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wazuh:wazuh_dashboard:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-112340"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Wazuh dashboard (4.9.0 - 4.14.8)"],"_cs_severities":["high"],"_cs_tags":["web-application","vulnerability","authentication-bypass","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["Wazuh"],"content_html":"\u003cp\u003eWazuh dashboard plugins in versions 4.9.0 through 4.14.8 contain an authorization bypass vulnerability (CVE-2026-112340) in the /api/request proxy endpoint. An authenticated user can supply a nested body.headers.Authorization value within a request, causing the dashboard to overwrite the server-side session Bearer token. This allows the attacker to impersonate other Manager API identities or submit unauthenticated requests to the backend API.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user to perform unauthorized actions with the privileges of another user or unauthenticated service account within the Wazuh Manager API, potentially leading to unauthorized system configuration changes or data access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Wazuh dashboard to version 4.14.9 or later to remediate CVE-2026-112340.\u003c/li\u003e\n\u003cli\u003eAudit logs for the /api/request endpoint to identify potential abuse of the authorization header modification.\u003c/li\u003e\n\u003cli\u003eImplement strict access controls for dashboard users to limit the potential impact of authenticated privilege escalation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T17:23:39Z","date_published":"2026-11-06T17:23:39Z","id":"https://feed.craftedsignal.io/briefs/2026-11-wazuh-auth-bypass/","summary":"An authorization bypass vulnerability in Wazuh dashboard versions 4.9.0 to 4.14.8 allows authenticated users to override Manager API Authorization headers via the /api/request endpoint.","title":"Wazuh Dashboard: Authorization bypass in /api/request proxy (CVE-2026-112340)","url":"https://feed.craftedsignal.io/briefs/2026-11-wazuh-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:wazuh:wazuh_dashboard:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}