CVE-2025-15617

Wazuh GitHub Actions Workflow Exposure of Sensitive Credentials

Published Mar 27, 2026 CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Description

Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOKEN from uploaded artifacts. Attackers can use the exposed token within a limited time window to perform unauthorized actions such as pushing malicious commits or altering release tags.

Analysis

Technical impact

Wazuh version 4.12.0 contains a flaw in the GitHub Actions workflow artifacts that allows the GITHUB_TOKEN to be extracted from uploaded artifacts. The exposed token can be used during its limited validity window to perform unauthorized operations such as pushing malicious commits or modifying release tags. The weakness is a credential exposure flaw (CWE-522).

Affected Systems

The vulnerability affects the Wazuh product, specifically the GitHub Actions workflows integrated with Wazuh 4.12.0. Users deploying this version are at risk if they publish workflow artifacts that include the GITHUB_TOKEN.

Risk and Exploitability

The CVSS score of 8.3 indicates a high severity, but the EPSS score of less than 1% suggests current exploitation likelihood is low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an adversary accessing publicly available workflow artifacts, from which the token can be extracted. Once obtained, the token can be used to authorize GitHub API actions until it expires.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Wazuh

Wazuh (GitHub Actions)

unaffected

Version	Status	Constraints
`4.12.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:wazuh:wazuh:4.12.0:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Wazuh

Version	Status	Scheme	Platform
`4.12.0`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Wazuh to the latest patched version that removes the exposed token from workflow artifacts
Configure GitHub Actions to prevent sensitive tokens from being included in uploaded artifacts
Review existing artifacts for any exposed credentials and delete them
Restrict artifact visibility to only trusted users or teams

Generated by OpenCVE AI on May 12, 2026 at 22:52 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.403% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/wazuh/wazuh/security/advisories/GHSA-6xqr-4q5g-xc7x
https://www.vulncheck.com/advisories/exposure-of-the-github-token-in-wazuh-workflow-run-artifact

History

May 12, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N'}`	cvssV4_0 `{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N'}`

Mar 31, 2026 6:00 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:wazuh:wazuh:4.12.0:::::::*

Mar 31, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 30, 2026 7:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wazuh Wazuh wazuh
Vendors & Products		Wazuh Wazuh wazuh

Mar 27, 2026 8:00 PM Title updated View changes

Type	Values Removed	Values Added
Title	Exposure of the GITHUB_TOKEN in wazuh workflow run artifact	Wazuh GitHub Actions Workflow Exposure of Sensitive Credentials

Mar 27, 2026 6:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOKEN from uploaded artifacts. Attackers can use the exposed token within a limited time window to perform unauthorized actions such as pushing malicious commits or altering release tags.
Title		Exposure of the GITHUB_TOKEN in wazuh workflow run artifact
Weaknesses		CWE-522
References		https://github.com/wazuh/wazuh/security/advisories/GHSA-6xqr-4q5g-xc7x https://www.vulncheck.com/advisories/exposure-of-the-github-token-in-wazuh-workflow-run-artifact
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L'}` cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N'}`