CVE-2026-112340 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Wazuh dashboard plugins from 4.9.0 before 4.14.9 let any logged-in dashboard user override the Manager API Authorization header through the /api/request proxy. An attacker can act as another Manager API identity or send unauthenticated requests to the upstream API.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Wazuh dashboard plugins in the affected range, where any user with a dashboard login can reach the /api/request proxy endpoint. Exposure depends on who holds dashboard accounts; deployments that restrict dashboard logins to trusted staff have a smaller risk surface, though the flaw still needs a login to exploit.
Not affected if no-dashboard-users, version-4.14.9-or-later
Who cares security-monitoring, self-hosted, wazuh
4.14.9.4.9.0 up to but not including 4.14.9.4.14.9 or later.Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace the server-side session Bearer token, letting them act as another Manager API identity or send unauthenticated upstream requests.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.