CVE-2026-112338

EUVD-2026-118281
Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module (wm_github.c) that trusts unvalidated Link rel="next" pagination URLs. Attackers controlling the next-page URL can make the manager send requests with the GitHub API token to attacker hosts, exposing organization repositories and settings.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
wazuhwazuh
4.3.0 ≤
𝑥
< 4.14.9
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/wazuh/wazuh/releases/tag/v4.14.9
https://github.com/wazuh/wazuh/security/advisories/GHSA-jmq7-vgh3-wq9v
https://www.vulncheck.com/advisories/wazuh-from-4.3.0-before-4.14.9-ssrf-via-github-module-link-pagination
https://github.com/wazuh/wazuh/security/advisories/GHSA-jmq7-vgh3-wq9v