← Vulnerability feed

Vulnerability record · CVE-2026-41424 · published 19 August 2026

CVE-2026-41424: Wazuh incorrect authorization vulnerability

Wazuh · Wazuh

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/{user_id} in api/api/controllers/security_controller.py passes request.get("user") instead of request.context['token_info']['sub'] as current_user. remove_nones_to_dict() removes the resulting None value, so the reserved-account protection in framework/wazuh/security.py cannot verify who is making the request. An authenticated user with the users_admin role can overwrite the password of protected administrator accounts with user IDs at or below 99, including the wazuh superuser, and gain full administrative control. This issue is fixed in versions 4.10.4 and 4.14.6.

8.2 CVSS 3.1 High EPSS 0.47% · top 61.7% CWE-863 · Incorrect authorization
8.2CVSS 3.1 base score
0.47%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 2 tagged exploit
18 Sep 2026Last modified by NVD

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/{user_id} in api/api/controllers/security_controller.py passes request.get("user") instead of request.context['token_info']['sub'] as current_user. remove_nones_to_dict() removes the resulting None value, so the reserved-account protection in framework/wazuh/security.py cannot verify who is making the request. An authenticated user with the users_admin role can overwrite the password of protected administrator accounts with user IDs at or below 99, including the wazuh superuser, and gain full administrative control. This issue is fixed in versions 4.10.4 and 4.14.6.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/wazuh/wazuh/commit/1a38d11574c6d35a4272e1e7145d55d293e7dda4 Patch
https://github.com/wazuh/wazuh/commit/813add3575ecd4df484b2326715ca78f65505b4e Patch
https://github.com/wazuh/wazuh/pull/35442 Issue TrackingPatch
https://github.com/wazuh/wazuh/pull/35469 Issue TrackingPatch
https://github.com/wazuh/wazuh/releases/tag/v4.10.4 Release Notes
https://github.com/wazuh/wazuh/releases/tag/v4.14.6 Release Notes
https://github.com/wazuh/wazuh/security/advisories/GHSA-gj9h-8hmr-xjjr ExploitVendor Advisory
https://github.com/wazuh/wazuh/security/advisories/GHSA-gj9h-8hmr-xjjr ExploitVendor Advisory

Track CVE-2026-41424 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2025-24016Wazuh server unsafe deserialization allows remote code executionWazuh versions 4.4.0 through 4.9.0 deserialize DistributedAPI parameters with an unsafe helper (as_wazuh_object), letting an attacker who can inject …KEVEPSS 94%analysed9.9CVE-2026-30893Wazuh path traversal vulnerabilityWazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to before version 4.14.4, a path tra…EPSS 0.62%9.8CVE-2024-32038Wazuh heap-based buffer overflow vulnerabilityWazuh is a free and open source platform used for threat prevention, detection, and response. There is a buffer overflow hazard in wazuh-analysisd wh…EPSS 1.0%9.8CVE-2021-44079Wazuh command injection vulnerabilityIn the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially resulting…EPSS 3.4%9.5CVE-2024-1243Wazuh improper input validation vulnerabilityImproper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the Wazuh server or agent key to…EPSS 0.64%9.1CVE-2026-61800Wazuh path traversal vulnerabilityWazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14…EPSS 0.98%9.1CVE-2026-49441Wazuh vulnerabilityWazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged…EPSS 0.77%9.1CVE-2026-48024Wazuh path traversal vulnerabilityWazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, cluster.unmerg…EPSS 0.78%

Source: NIST National Vulnerability Database (record CVE-2026-41424), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.