CVE WATCH / VULNERABILITY DETAIL
CVE-2026-112340
HIGHCVSS 8.2NVD feed
Published 6 November 2026 · tracked since 7 November 2026
Description
Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace th
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog