CVE-2026-112337

Name of the Vulnerable Software and Affected Versions Wazuh versions 3.7.0 through 4.14.8

Description A server-side request forgery issue exists in the Azure wodle get graph events() function. The function follows the @odata.nextLink variable without performing host or HTTPS validation. This allows attackers who can influence the @odata.nextLink value to redirect manager requests to endpoints under their control, enabling the capture of the reused Microsoft Graph bearer token and access to internal services.

Recommendations Update to version 4.14.9 or later. As a temporary mitigation, restrict the use of the get graph events() function in the Azure wodle.