The vulnerability in Wazuh version 4.12.0 exposes the GitHub Actions workflow artifact containing the GITHUB_TOKEN. This secret can be extracted by attackers who can access the artifact. During the limited validity period of the token, the attacker can inject malicious commits or override release tags.

Affected systems are Wazuh releases identifying as Wazuh:Wazuh (GitHub Actions) with the affected version listed as 4.12.0. No other version or product information was provided.

The CVSS score of 6.3 indicates moderate severity. No EPSS score is available and the vulnerability is not in CISA's KEV catalog. The likely attack vector involves remote exploitation via access to workflow artifacts on GitHub; an attacker must obtain the artifact to retrieve the token. The impact is higher when the token has write privileges, allowing unauthorized pushes or tag modifications within the token's short‑lived window.