CVE-2026-112340
Published:November 06, 2026
Updated:November 09, 2026
Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace the server-side session Bearer token, letting them act as another Manager API identity or send unauthenticated upstream requests.
Affected Packages
https://github.com/wazuh/wazuh-dashboard-plugins.git (GITHUB):
Affected version(s) >=v5.0.0-alpha0 <v5.0.0-rc1Fix Suggestion:
Update to version v5.0.0-rc1https://github.com/wazuh/wazuh-dashboard-plugins.git (GITHUB):
Affected version(s) >=v4.9.0 <v4.14.9Fix Suggestion:
Update to version v4.14.9Related Resources (6)
Do you need more information?
Contact UsCVSS v4
Base Score:
8.8
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
PRESENT
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
NONE
Subsequent System Confidentiality
HIGH
Subsequent System Integrity
HIGH
Subsequent System Availability
NONE
CVSS v3
Base Score:
8.2
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Weakness Type (CWE)
Incorrect Authorization
EPSS
Base Score:
0.35