GHSA-jmq7-vgh3-wq9v: Wazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination

Published Nov 6, 2026

Updated

Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module (wmgithub.c) that trusts unvalidated Link rel="next" pagination URLs. Attackers controlling the next-page URL can make the manager send requests with the GitHub API token to attacker hosts, exposing organization repositories and settings.

Event History

Nov 6, 2026

CVE Published

via OSV·03:00 PM

Data Sourced

via OSV·03:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Wazuh versions from 4.3.0 before 4.14.9 are affected when the GitHub module processes pagination responses containing an attacker-controlled Link rel="next" URL.

What does an attacker need to exploit this issue?

The attacker must be able to control the next-page pagination URL consumed by the GitHub module. The vulnerable manager then follows that URL and includes its GitHub API token in requests to an attacker-controlled host.

What is the impact of a successful exploit?

An attacker can obtain the GitHub API token used by the Wazuh manager. This may expose the organization's repositories and settings accessible through that token.

What version addresses the vulnerability?

Wazuh 4.14.9 addresses the issue. Versions earlier than 4.14.9 within the affected range should be treated as vulnerable.

GHSA-jmq7-vgh3-wq9v: Wazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the impact of a successful exploit?

What version addresses the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the impact of a successful exploit?

What version addresses the vulnerability?