This flaw is a server‑side request forgery that allows an attacker to influence the @odata.nextLink value processed by the Wazuh Azure Graph get_graph_events() function. Because the function does not validate the host or enforce HTTPS, the manager can be redirected to attacker‑controlled endpoints, thereby capturing the reused Microsoft Graph bearer token and enabling access to internal services. The vulnerability is classified as CWE‑918.

Vulnerable Wazuh deployments include any installation from version 3.7.0 up to and including 4.14.8. The fix is included in release 4.14.9 and later. All users running any of these affected versions are at risk.

The CVSS base score of 6.3 indicates a medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that, while exploitation is possible, it is not yet widely observed. Based on the description, it is inferred that the attacker would need to supply a crafted nextLink value that the function processes. This presumably requires the attacker to have a path to influence the nextLink, such as access to a Wazuh API endpoint or configuration file. If such access can be obtained, the SSRF can be leveraged to redirect internal traffic and exfiltrate the Microsoft Graph bearer token, giving the attacker access to internal resources.