Wazuh Dashboard (4.9.0 - 4.14.8) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/wazuh-dashboard-4.9.0---4.14.8/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 06 Nov 2026 17:23:39 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWazuh Dashboard: Authorization bypass in /api/request proxy (CVE-2026-112340)https://feed.craftedsignal.io/briefs/2026-11-wazuh-auth-bypass/Fri, 06 Nov 2026 17:23:39 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-wazuh-auth-bypass/An authorization bypass vulnerability in Wazuh dashboard versions 4.9.0 to 4.14.8 allows authenticated users to override Manager API Authorization headers via the /api/request endpoint.Wazuh dashboard plugins in versions 4.9.0 through 4.14.8 contain an authorization bypass vulnerability (CVE-2026-112340) in the /api/request proxy endpoint. An authenticated user can supply a nested body.headers.Authorization value within a request, causing the dashboard to overwrite the server-side session Bearer token. This allows the attacker to impersonate other Manager API identities or submit unauthenticated requests to the backend API.

Impact

Successful exploitation allows an authenticated user to perform unauthorized actions with the privileges of another user or unauthenticated service account within the Wazuh Manager API, potentially leading to unauthorized system configuration changes or data access.

Recommendation

  • Upgrade the Wazuh dashboard to version 4.14.9 or later to remediate CVE-2026-112340.
  • Audit logs for the /api/request endpoint to identify potential abuse of the authorization header modification.
  • Implement strict access controls for dashboard users to limit the potential impact of authenticated privilege escalation.
]]>highadvisoryweb-applicationvulnerabilityauthentication-bypassprivilege-escalation