CVE-2026-112338

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.3.0 through 4.14.8

Description A server-side request forgery (SSRF) issue exists in the GitHub module (wm github.c). The system trusts unvalidated Link rel="next" pagination URLs, allowing an attacker who controls the next-page URL to force the manager to send requests containing the GitHub API token to external hosts. This can lead to the exposure of organization repositories and settings.

Recommendations Update Wazuh to version 4.14.9 or later.