CVE-2026-112337

CVSS 6.3 (medium) · published 2026-11-06

Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle get_graph_events() function that follows @odata.nextLink without host or HTTPS validation. Attackers who influence the nextLink value can redirect manager requests to attacker-controlled endpoints, capturing the reused Microsoft Graph bearer token and reaching internal services.

Weakness: CWE-918

Source: NVD CVE-2026-112337

References

• https://github.com/wazuh/wazuh/releases/tag/v4.14.9
• https://github.com/wazuh/wazuh/security/advisories/GHSA-qxg8-jrjm-w96h
• https://www.vulncheck.com/advisories/wazuh-3.7.0-before-4.14.9-ssrf-via-azure-graph-nextlink-pagination

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.