Authentication Bypass in Wazuh API

Executive Summary

CVE-2026-41424 is a privilege escalation flaw in Wazuh affecting versions 4.9.0 to 4.10.4 and 4.14.6. The vulnerability occurs in the PUT /security/users/{user_id} API endpoint where the code incorrectly uses request.get("user") instead of request.context['token_info']['sub'] to identify the authenticated user. This bypasses admin-protection logic, allowing users with the users_admin role to overwrite passwords of administrator accounts with user IDs at or below 99, including the superuser account.

Useful 0 Not Useful 0

Detection Guidance

Check Wazuh API logs for suspicious PUT requests to /security/users/{user_id} endpoints. Look for requests where the user context is missing or invalid. Verify if non-admin users with users_admin role attempted to modify admin accounts (user IDs ≤ 99).

Use Wazuh's framework logs to confirm if admin-protection errors (WazuhError 5011) are being triggered incorrectly. Compare API behavior against expected security controls.

Useful 0 Not Useful 0

Impact Analysis

An attacker with users_admin privileges could exploit this to change passwords of admin accounts, gaining full administrative control over the Wazuh deployment. This could lead to unauthorized access, data manipulation, or complete system compromise. The vulnerability allows bypassing intended security controls that prevent non-admin users from modifying admin accounts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements for access control and data protection in standards like GDPR and HIPAA. It undermines security controls designed to prevent privilege escalation and unauthorized modifications to critical system accounts.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Wazuh to version 4.10.4 or 4.14.6 or later to apply the official fix. If upgrading is not immediately possible, restrict access to the PUT /security/users/{user_id} endpoint via network controls or API gateways.

Audit all admin accounts (user IDs ≤ 99) for unauthorized changes. Monitor for unexpected privilege escalations or modifications to superuser accounts.

Useful 0 Not Useful 0