CVE-2026-112337 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Wazuh's Azure wodle follows the @odata.nextLink URL returned by Microsoft Graph without checking the host or requiring HTTPS. An attacker who can influence that value can redirect the manager's requests to their own server, capturing the reused Microsoft Graph bearer token and reaching internal services.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running a Wazuh manager with the Azure wodle enabled to pull Microsoft Graph events. Exposure depends on whether an attacker can influence the nextLink value returned to the manager. Managers without the Azure integration are not affected.
Not affected if azure-wodle-disabled, wazuh-4.14.9-or-later
Who cares azure, microsoft-graph, self-hosted, wazuh
/var/ossec/bin/wazuh-control info (the sources do not name a check beyond the version range).azure-logs) is configured on the manager.4.14.9 (the range is 3.7.0 before 4.14.9).Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle get_graph_events() function that follows @odata.nextLink without host or HTTPS validation. Attackers who influence the nextLink value can redirect manager requests to attacker-controlled endpoints, capturing the reused Microsoft Graph bearer token and reaching internal services.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.