CVE-2026-112340
HIGH
NVD
CVSS Score
8.2
Severity
HIGH
Published
Nov 06, 2026
Vendor
unknown
Description
Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace the server-side session Bearer token, letting them act as another Manager API identity or send unauthenticated upstream requests.