{"id":"CVE-2026-112337","kind":"vulnerability","aliases":["CVE-2026-112337"],"related":[],"title":"Wazuh: Azure integration follows attacker-chosen links and leaks bearer token","description":"Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle get_graph_events() function that follows @odata.nextLink without host or HTTPS validation. Attackers who influence the nextLink value can redirect manager requests to attacker-controlled endpoints, capturing the reused Microsoft Graph bearer token and reaching internal services.","summary":"Wazuh's Azure wodle follows the @odata.nextLink URL returned by Microsoft Graph without checking the host or requiring HTTPS. An attacker who can influence that value can redirect the manager's requests to their own server, capturing the reused Microsoft Graph bearer token and reaching internal services.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["azure","infrastructure","microsoft-graph","self-hosted","wazuh"],"not_affected_if":["azure-wodle-disabled","wazuh-4.14.9-or-later"],"how_to_check":"- Check the installed Wazuh manager version with `/var/ossec/bin/wazuh-control info` (the sources do not name a check beyond the version range).\n- Confirm whether the Azure wodle (`azure-logs`) is configured on the manager.","fix":"- Wazuh from `4.14.9` (the range is `3.7.0` before `4.14.9`).","status":"open","published_at":"2026-11-06T15:17:08+00:00","first_seen_at":"2026-11-06T15:42:43+00:00","triaged_at":"2026-11-06T15:44:32+00:00","updated_at":"2026-11-06T15:44:32+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-06T15:44:32Z","model":"claude-haiku-5-5","output":{"fix":"- Wazuh from `4.14.9` (the range is `3.7.0` before `4.14.9`).","reach":"network","title":"Wazuh: Azure integration follows attacker-chosen links and leaks bearer token","impact":"high","summary":"Wazuh's Azure wodle follows the @odata.nextLink URL returned by Microsoft Graph without checking the host or requiring HTTPS. An attacker who can influence that value can redirect the manager's requests to their own server, capturing the reused Microsoft Graph bearer token and reaching internal services.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["wazuh","self-hosted","azure","microsoft-graph"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Microsoft Graph bearer token is captured and internal services are reached","analyst_note":"Confirm the exact attacker position needed to influence nextLink and check the vendor advisory at github.com for the precise check and affected configuration.","how_to_check":"- Check the installed Wazuh manager version with `/var/ossec/bin/wazuh-control info` (the sources do not name a check beyond the version range).\n- Confirm whether the Azure wodle (`azure-logs`) is configured on the manager.","plain_action":"","needs_analyst":true,"not_affected_if":["azure-wodle-disabled","wazuh-4.14.9-or-later"],"who_is_affected":"Teams running a Wazuh manager with the Azure wodle enabled to pull Microsoft Graph events. Exposure depends on whether an attacker can influence the nextLink value returned to the manager. Managers without the Azure integration are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000746,"input_tokens":4320,"output_tokens":627,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112337':15A,18A '-2026':14A,17A '3.7.0':77C '4.14.9':79C 'attack':6A,48B,104C,116C 'attacker-chosen':5A 'attacker-control':115C 'azur':2A,19B,30B,90C 'bearer':11A,69B,124C 'captur':64B,119C 'check':41B 'chosen':7A 'contain':80C 'control':117C 'cve':13A,16A 'endpoint':118C 'event':94C 'follow':4A,32B,97C 'forgeri':86C 'function':95C 'get':92C 'graph':23B,39B,68B,93C,123C 'host':26B,43B,100C 'https':46B,102C 'influenc':51B,106C 'infrastructur':20B 'integr':3A 'intern':73B,128C 'leak':10A 'link':8A 'manag':57B,112C 'microsoft':22B,38B,67B,122C 'microsoft-graph':21B 'nextlink':108C 'odata.nextlink':34B,98C 'reach':72B,127C 'redirect':55B,111C 'request':59B,85C,113C 'requir':45B 'return':36B 'reus':66B,121C 'self':25B 'self-host':24B 'server':63B,83C 'server-sid':82C 'servic':74B,129C 'side':84C 'token':12A,70B,125C 'url':35B 'valid':103C 'valu':53B,109C 'vulner':87C 'wazuh':1A,27B,28B,75C 'without':40B,99C 'wodl':31B,91C","nicknames":[],"mitigations":[],"who_affected":"Teams running a Wazuh manager with the Azure wodle enabled to pull Microsoft Graph events. Exposure depends on whether an attacker can influence the nextLink value returned to the manager. Managers without the Azure integration are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["azure","infrastructure","medium","microsoftgraph","selfhosted","wazuh"],"campaign_type":null,"search_a":"'-112337':15A,18A '-2026':14A,17A 'attack':6A 'attacker-chosen':5A 'azur':2A 'bearer':11A 'chosen':7A 'cve':13A,16A 'follow':4A 'integr':3A 'leak':10A 'link':8A 'token':12A 'wazuh':1A","search_b":"'attack':48B 'azur':19B,30B 'bearer':69B 'captur':64B 'check':41B 'follow':32B 'graph':23B,39B,68B 'host':26B,43B 'https':46B 'influenc':51B 'infrastructur':20B 'intern':73B 'manag':57B 'microsoft':22B,38B,67B 'microsoft-graph':21B 'odata.nextlink':34B 'reach':72B 'redirect':55B 'request':59B 'requir':45B 'return':36B 'reus':66B 'self':25B 'self-host':24B 'server':63B 'servic':74B 'token':70B 'url':35B 'valu':53B 'wazuh':27B,28B 'without':40B 'wodl':31B","search_c":"'3.7.0':77C '4.14.9':79C 'attack':104C,116C 'attacker-control':115C 'azur':90C 'bearer':124C 'captur':119C 'contain':80C 'control':117C 'endpoint':118C 'event':94C 'follow':97C 'forgeri':86C 'function':95C 'get':92C 'graph':93C,123C 'host':100C 'https':102C 'influenc':106C 'intern':128C 'manag':112C 'microsoft':122C 'nextlink':108C 'odata.nextlink':98C 'reach':127C 'redirect':111C 'request':85C,113C 'reus':121C 'server':83C 'server-sid':82C 'servic':129C 'side':84C 'token':125C 'valid':103C 'valu':109C 'vulner':87C 'wazuh':75C 'without':99C 'wodl':91C","first_public_at":"2026-11-06T10:28:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112337","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112337","severity":null,"published_at":"2026-11-06T15:17:08+00:00","modified_at":"2026-11-06T15:17:08+00:00","first_seen_at":"2026-11-06T15:42:43+00:00","fetched_at":"2026-11-06T15:42:43+00:00","note":null}],"documents":[{"id":87519,"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.9","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":87531,"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-qxg8-jrjm-w96h","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-06T10:28:14+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":87532,"url":"https://www.vulncheck.com/advisories/wazuh-3.7.0-before-4.14.9-ssrf-via-azure-graph-nextlink-pagination","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}