Description

Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace the server-side session Bearer token, letting them act as another Manager API identity or send unauthenticated upstream requests.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-11-06T15:17:08.537Z",
  "pubdate": "2026-11-06T15:17:08.537Z",
  "executiveSummary": "An authorization bypass vulnerability exists in Wazuh dashboard plugins affecting versions from 4.9.0 before 4.14.9. The security flaw is located within the /api/request proxy endpoint, which facilitates communications between the user dashboard and the backend Manager API. The issue stems from improper handling of user-controlled request headers when proxying API traffic, allowing authenticated dashboard users to inject nested payload parameters that alter outbound request configurations.\nBy submitting a specially crafted payload containing nested body.headers.Authorization values to the vulnerable proxy endpoint, an attacker can override the server-side session Bearer token attached to the upstream request. This enables authenticated attackers to impersonate other Manager API identities or send unauthenticated upstream requests to backend services. Successful exploitation leads to unauthorized privilege escalation, exposure of restricted Manager API functionalities, and potential compromise of administrative security operations.",
  "technicalDetails": "The root cause of this vulnerability lies in the parameter parsing and header construction logic used by the Wazuh dashboard plugins when handling client requests targeted at the /api/request proxy endpoint. In standard operation, the dashboard acts as a reverse proxy that translates user interactions into Manager API calls, appending a server-side session Bearer token in the HTTP Authorization header to authenticate the request against the upstream backend.\nHowever, the /api/request endpoint accepts client-defined request properties within the payload body without adequately restricting header override parameters. When processing incoming JSON payloads, the endpoint parses nested structures under the body.headers object. Because the internal proxy implementation merges these incoming body parameters directly into the final HTTP request context, user-supplied values in body.headers.Authorization take precedence over the legitimate server-managed session Bearer token.\nAn attack proceeds through the following sequence: An attacker first authenticates to the Wazuh dashboard as a standard user to obtain valid access to the dashboard interface. The attacker then constructs a POST request targeting the /api/request proxy endpoint. Inside the request payload, the attacker defines a nested body.headers.Authorization parameter containing a targeted identity's token, a privileged token, or a modified value designed to bypass identity verification.\nWhen the /api/request endpoint receives this payload, the backend proxy logic merges the user-defined nested headers into the outgoing HTTP context, replacing the server's session Bearer token with the attacker-controlled Authorization value. The manipulated request is subsequently forwarded to the Manager API. The upstream Manager API evaluates the inbound call using the spoofed Authorization header, executing the requested command under the security context of the injected identity or processing it as an unauthenticated request. This grants the attacker unauthorized access to sensitive endpoints and administrative functions on the Manager API."
}