CVE-2026-112340Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request

Descripción

Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace the server-side session Bearer token, letting them act as another Manager API identity or send unauthenticated upstream requests.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• GitHub Security Advisory (GHSA-7rvv-9467-96mc) vendor-advisorythird-party-advisory
• wazuh-dashboard-plugins v4.14.9 Release Notes release-notes
• VulnCheck Advisory: Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request third-party-advisory