Wazuh up to 4.10.3/4.14.5 Security Controller security_controller.py remove_nones_to_dict User privileges management

Summaryinfo

A vulnerability classified as very critical was found in Wazuh up to 4.10.3/4.14.5. Affected by this issue is the function remove_nones_to_dict of the file api/api/controllers/security_controller.py of the component Security Controller. Such manipulation of the argument User leads to privileges management. This vulnerability is listed as CVE-2026-41424. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Wazuh up to 4.10.3/4.14.5. It has been rated as very critical. Affected by this issue is the function remove_nones_to_dict of the file api/api/controllers/security_controller.py of the component Security Controller. The manipulation of the argument user with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/{user_id} in api/api/controllers/security_controller.py passes request.get("user") instead of request.context['token_info']['sub'] as current_user. remove_nones_to_dict() removes the resulting None value, so the reserved-account protection in framework/wazuh/security.py cannot verify who is making the request. An authenticated user with the users_admin role can overwrite the password of protected administrator accounts with user IDs at or below 99, including the wazuh superuser, and gain full administrative control. This issue is fixed in versions 4.10.4 and 4.14.6.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-41424 since 04/20/2026. The exploitation is known to be easy. The attack may be launched remotely. Additional levels of successful authentication are necessary for exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 08/19/2026). This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

Upgrading to version 4.10.4 or 4.14.6 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Wazuh

Version

• 4.10.0
• 4.10.1
• 4.10.2
• 4.10.3
• 4.14.0
• 4.14.1
• 4.14.2
• 4.14.3
• 4.14.4
• 4.14.5

Website

• Product: https://github.com/wazuh/wazuh/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion