CVE-2026-112338 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Wazuh's GitHub integration follows the next-page URL in GitHub API responses without checking it, so a manipulated link makes the Wazuh manager send its GitHub API token to an attacker-chosen host. An attacker who gets that token can read the organization's repositories and settings.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running a self-hosted Wazuh manager with the GitHub module configured to pull from GitHub organizations. The exposure comes from the token the module uses and the pagination handling in wm_github.c, so a manager without the GitHub module is not affected. Managed or SaaS Wazuh deployments are the vendor's to patch.
Not affected if github-module-disabled, managed-hosting, wazuh-below-4.3.0
Who cares github-integration, self-hosted, wazuh
/var/ossec/bin/wazuh-control info or wazuh-manager -V.wm_github) in the manager's ossec.conf under the GitHub integration settings.4.14.9 or later (fixed version given in the sources for versions from 4.3.0).Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module (wm_github.c) that trusts unvalidated Link rel="next" pagination URLs. Attackers controlling the next-page URL can make the manager send requests with the GitHub API token to attacker hosts, exposing organization repositories and settings.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.