---
id: "CVE-2026-112337"
page: "https://infrastack.ai/live/CVE-2026-112337"
kind: "vulnerability"
aliases: ["CVE-2026-112337"]
title: "Wazuh: Azure integration follows attacker-chosen links and leaks bearer token"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["azure", "infrastructure", "microsoft-graph", "self-hosted", "wazuh"]
not_affected_if: ["azure-wodle-disabled", "wazuh-4.14.9-or-later"]
published_at: "2026-11-06T15:17:08+00:00"
first_seen_at: "2026-11-06T15:42:43+00:00"
updated_at: "2026-11-06T15:44:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112337", "first_seen_at": "2026-11-06T15:42:43+00:00"}]
exploit_sources: []
---

# Wazuh: Azure integration follows attacker-chosen links and leaks bearer token

Link for people: https://infrastack.ai/live/CVE-2026-112337 (this .md is for agents)

Wazuh's Azure wodle follows the @odata.nextLink URL returned by Microsoft Graph without checking the host or requiring HTTPS. An attacker who can influence that value can redirect the manager's requests to their own server, capturing the reused Microsoft Graph bearer token and reaching internal services.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Wazuh manager version with `/var/ossec/bin/wazuh-control info` (the sources do not name a check beyond the version range).
- Confirm whether the Azure wodle (`azure-logs`) is configured on the manager.

## Fix

- Wazuh from `4.14.9` (the range is `3.7.0` before `4.14.9`).

## Timeline

- 2026-11-06T15:42:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112337

## Documents

- [advisory] Vendor advisory: github.com https://github.com/wazuh/wazuh/security/advisories/GHSA-qxg8-jrjm-w96h
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/wazuh-3.7.0-before-4.14.9-ssrf-via-azure-graph-nextlink-pagination
- [fix] Release notes: github.com https://github.com/wazuh/wazuh/releases/tag/v4.14.9

## From the sources

Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle get_graph_events() function that follows @odata.nextLink without host or HTTPS validation. Attackers who influence the nextLink value can redirect manager requests to attacker-controlled endpoints, capturing the reused Microsoft Graph bearer token and reaching internal services.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_