Is CVE-2026-112340 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112340 being exploited in the wild.

How severe is CVE-2026-112340?

High severity, with a CVSS score of 8.2, published 6 November 2026.

Which products and versions are affected?

Wazuh Dashboard Plugins 4.9.0 before 4.14.9.

How is CVE-2026-112340 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-112340?

Check whether you run Wazuh Dashboard Plugins at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112340: Wazuh dashboard plugins authorization bypass via API request proxy

CVE-2026-112340 · Severity: high · CVSS 8.2 · Published 2026-11-06

Wazuh dashboard is a web interface that proxies requests to the Wazuh Manager API on behalf of authenticated users. An authenticated dashboard user can override the server's session credentials by injecting a malicious Authorization header in the request body, allowing them to impersonate other API users or make unauthenticated requests to the Manager. This breaks the security model where the server controls which API identity is used.

Vendors: Wazuh.

Quick answers

Is CVE-2026-112340 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112340 being exploited in the wild.
How severe is CVE-2026-112340?: High severity, with a CVSS score of 8.2, published 6 November 2026.
Which products and versions are affected?: Wazuh Dashboard Plugins 4.9.0 before 4.14.9.
Is there a fix for CVE-2026-112340?: Yes: fixed in 4.14.9. Until then: Restrict access to the /api/request endpoint to trusted users only, or disable Dev Tools / API request features for low-privilege accounts until the patch is applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112340 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-112340?: Check whether you run Wazuh Dashboard Plugins at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.14.9

Restrict access to the /api/request endpoint to trusted users only, or disable Dev Tools / API request features for low-privilege accounts until the patch is applied.

Technical details

The vulnerability exists in the server-api-client.ts request builder, which sets the Authorization header with the server's session Bearer token but then spreads client-supplied headers on top, allowing the client to override Authorization. An authenticated user can POST to /api/request with nested body.headers.Authorization values that replace the server-side token, gaining access to other API identities or bypassing authentication entirely if they possess or can guess valid tokens.

Affected products

Wazuh dashboard plugins 4.9.0 before 4.14.9

Timeline

2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.