Server-Side Request Forgery in Wazuh Affects Azure Integration
CVE-2026-112337

6.3MEDIUM

Key Information:

Vendor

Wazuh

Status
Wazuh
Vendor
CVE Published:
6 November 2026

What is CVE-2026-112337?

Wazuh versions prior to 4.14.9 are vulnerable to a server-side request forgery (SSRF) in the Azure module's get_graph_events() function. This vulnerability occurs when the function processes the @odata.nextLink value without performing proper validation for the host or HTTPS scheme. By manipulating the nextLink parameter, an attacker could redirect requests from the Wazuh manager to their own endpoints. This could potentially allow the attacker to capture the Microsoft Graph bearer token in use, leading to unauthorized access to internal services.

Affected Version(s)

wazuh 3.7.0 < 4.14.9

wazuh 4.14.9

References

https://github.com/wazuh/wazuh/security/advisories/GHSA-q...
vendor-advisory
https://github.com/wazuh/wazuh/releases/tag/v4.14.9
release-notes
https://www.vulncheck.com/advisories/wazuh-3.7.0-before-4...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ShivarajRN
vikman90
.