Description
Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace the server-side session Bearer token, letting them act as another Manager API identity or send unauthenticated upstream requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| wazuh | wazuh-dashboard-plugins | 4.9.0 – < 4.14.9 | 4.14.9 |
Advisories 1
- WID-SEC-2026-4377 Wazuh: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
References
- GitHub Security Advisory (GHSA-7rvv-9467-96mc) vendor-advisory third-party-advisory
- wazuh-dashboard-plugins v4.14.9 Release Notes release-notes
- VulnCheck Advisory: Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request third-party-advisory