CVE-2026-112338: Wazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination
Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module (wmgithub.c) that trusts unvalidated Link rel="next" pagination URLs. Attackers controlling the next-page URL can make the manager send requests with the GitHub API token to attacker hosts, exposing organization repositories and settings.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Wazuh versions from 4.3.0 up to, but not including, 4.14.9 are affected where the GitHub module processes pagination links. The issue is in the manager-side GitHub module.
What does an attacker need to exploit it?
An attacker needs control over a GitHub API Link header's rel="next" pagination URL. The vulnerable module trusts that URL and follows it without validation.
What can be exposed if exploitation succeeds?
The Wazuh manager can send requests to an attacker-controlled host using its GitHub API token. This can expose organization repositories and settings to the attacker host.
What remediation is identified?
Upgrade Wazuh to version 4.14.9 or later. Version 4.14.9 is identified as the release fixing affected versions before it.