CVE-2026-41424: Wazuh: Privilege Escalation via Admin-Protection Bypass in update-user API Endpoint

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-08-19 · updated 2026-10-26
Weakness: CWE-863

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/{user_id} in api/api/controllers/security_controller.py passes request.get("user") instead of request.context['token_info']['sub'] as current_user. remove_nones_to_dict() removes the resulting None value, so the reserved-account protection in framework/wazuh/security.py cannot verify who is making the request. An authenticated user with the users_admin role can overwrite the password of protected administrator accounts with user IDs at or below 99, including the wazuh superuser, and gain full administrative control. This issue is fixed in versions 4.10.4 and 4.14.6.

Affected products

wazuh: from 4.9.0 before 4.10.4; from 4.11.0 before 4.14.6 — fixed in 4.10.4, 4.14.6

How to fix

Upgrade to a fixed version: wazuh 4.10.4, 4.14.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-41424 or the next vulnerability affects your stack