Read the docs
TI-2026-85943 Aliases CVE-2026-112338

Server-side request forgery in Wazuh GitHub module leaks API token

Priority HIGH 69CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery flaw in the GitHub module (CWE-918). The module trusts unvalidated Link rel='next' pagination URLs returned during API calls. A remote attacker without privileges who controls a next-page URL can make the manager send requests carrying the GitHub API token to attacker-controlled hosts, exposing organization repositories and settings.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module (wm_github.c) that trusts unvalidated Link rel="next" pagination URLs. Attackers controlling the next-page URL can make the manager send requests with the GitHub API token to attacker hosts, exposing organization repositories and settings.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00397 34th percentileScored 2026-11-07
Fix Fixed wazuh (wazuh): 4.14.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Wazuhwazuh4.3.0 to before 4.14.94.14.9Patch availableCNA
  • wazuh VendorWazuh Affected 4.3.0 to before 4.14.9 Fixed in 4.14.9 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*——Wazuh
  • cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:* Versions — — ·Wazuh

Remediation

Upgrade Wazuh to version 4.14.9, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA wazuh (wazuh) Fixed in 4.14.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    wazuh 4.14.9

    7 records Highest priority Priority HIGH 1 HIGH, 6 LOW

    Other records, highest priority first

    • TI-2026-85944 Missing TLS hostname verification in Wazuh fluent-forward modulePriority LOW 35
    • TI-2026-85941 Wazuh Manager JSON Decoder Memory Leak Enables Denial of ServicePriority LOW 32
    • TI-2026-85946 SQL injection in Wazuh WazuhDBBackend exposes agent internal keysPriority LOW 31
    Show all 7 records →

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-112338
  2. 2026-11-06 CISA SSVC decision points changed
  3. 2026-11-06 Priority changed: MEDIUM → HIGH

References

Advisory 1

Other 1

  • TI-2025-17783 Remote code execution in Wazuh server KEVCVSS 3.1CRITICAL 9.9
  • TI-2026-47604 Wazuh GitHub Actions Shell Injection via Fork Pull Request CVSS 4.0CRITICAL 9.3
  • TI-2026-71739 Missing origin check in Wazuh manager allows arbitrary file read CVSS 4.0HIGH 8.7
  • TI-2026-71743 Arbitrary file overwrite in Wazuh manager enables root code execution CVSS 4.0CRITICAL 9.4
  • TI-2026-23722 Path traversal in wazuh CVSS 3.1CRITICAL 9.9
  • TI-2024-01157 Remote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theft CVSS 4.0CRITICAL 9.5
See all 101 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences