Wazuh versions from 4.3.0 up to 4.14.8 contain an SSRF flaw in the GitHub module that blindly trusts pagination URLs with rel=next. The flaw allows an attacker who can influence the next-page link to cause the Wazuh manager to issue requests to arbitrary hosts while automatically attaching the manager’s GitHub API token. This leaks credentials that grant read access to organization repositories and settings, potentially enabling further unauthorized activity.

The vulnerability affects Wazuh manager deployments using versions 4.3.0 through 4.14.8. No particular operating system or environment restrictions are cited, implying all supported installations are liable.

The CVSS score of 8.2 indicates a high severity of this SSRF weakness. The EPSS score is not available and the issue is not listed in CISA KEV, suggesting no known mass exploitation at this time. The likely attack vector is remote exploitation of the GitHub module configuration or API; the attacker must be able to inject or control the next-page URL, either through a compromised API key or by abusing the integration settings in the Wazuh manager. This inference is based on the description, as the attack path is not fully detailed in the available data.