Server-Side Request Forgery in Wazuh GitHub Module Affects Organization Repositories

CVE-2026-112338

What is CVE-2026-112338?

Wazuh versions from 4.3.0 up to, but not including, 4.14.9 are vulnerable to a server-side request forgery (SSRF). This vulnerability arises from the GitHub module, where it inadequately validates Link rel="next" pagination URLs. Malicious actors can exploit this weakness by manipulating the next-page URL, prompting the Wazuh manager to issue requests to attacker-controlled hosts using the GitHub API token. This compromised interaction can expose sensitive organization repositories and configuration settings, posing significant security risks.

References