Wazuh version 4.12.0 contains a flaw in the GitHub Actions workflow artifacts that allows the GITHUB_TOKEN to be extracted from uploaded artifacts. The exposed token can be used during its limited validity window to perform unauthorized operations such as pushing malicious commits or modifying release tags. The weakness is a credential exposure flaw (CWE-522).

The vulnerability affects the Wazuh product, specifically the GitHub Actions workflows integrated with Wazuh 4.12.0. Users deploying this version are at risk if they publish workflow artifacts that include the GITHUB_TOKEN.

The CVSS score of 6.3 indicates a moderate to high severity, but the EPSS score of less than 1% suggests current exploitation likelihood is low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an adversary accessing publicly available workflow artifacts, from which the token can be extracted. Once obtained, the token can be used to authorize GitHub API actions until it expires.