CVE-2026-112337

Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle getgraphevents function that follows @odata.nextLink without host or HTTPS validation. Attackers who influence the nextLink value can redirect manager requests to attacker-controlled endpoints,...

CVE-2026-112337

Wazuh versions 3.7.0 before 4.14.9 are vulnerable to a server-side request forgery (SSRF) vulnerability within the Azure wodle get_graph_events() function. The root cause is the lack of host or HTTPS validation when following the @odata.nextLink parameter. An attacker who can influence the nextLi...

EUVD-2026-118280

Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle getgraphevents function that follows @odata.nextLink without host or HTTPS validation. Attackers who influence the nextLink value can redirect manager requests to attacker-controlled endpoints,...

CVE-2026-112337: wazuh: Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle…

Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle getgraphevents function that follows @odata.nextLink without host or HTTPS validation. Attackers who influence the nextLink value can redirect manager requests to attacker-controlled endpoints,...