CVE-2026-67308

Wazuh GitHub Actions Shell Injection via Fork Pull Request

Published Aug 1, 2026 CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Description

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.

Analysis

Technical impact

The vulnerability allows an attacker to inject shell metacharacters into environment variables that are directly interpolated into GitHub Actions run steps within the Wazuh CI pipeline. This flaw permits execution of arbitrary commands when a crafted pull request is merged, potentially exposing secrets such as GITHUB_TOKEN and AWS credentials. The impact is the compromise of confidentiality and integrity of the continuous integration environment, with the attacker able to execute code on self‑hosted runners.

Affected Systems

Wazuh product. All releases before commit 44bf114 in the Wazuh repository are impacted; the vulnerability exists in the workflow configuration of those versions.

Risk and Exploitability

The CVSS score of 9.3 indicates critical severity. EPSS score of 0.00561 indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker who can submit a pull request with a crafted VERSION.json file that injects malicious shell commands into environment variables will trigger the vulnerable workflow and execute arbitrary commands on self‑hosted runners. The likely attack vector is via pull request submission; based on the description, it is inferred that the attacker would need write access to a repository or a fork that triggers the action.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

wazuh

unaffected

Version	Status	Constraints
`0`	affected	< 44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263
`44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263`	unaffected	—

No data.

Vendor Product Versions

Wazuh

Version	Status	Scheme	Platform
`[0,44bf114)`	affected	generic	—
`44bf114`	unaffected	code_commit	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Wazuh to a commit after 44bf114 or to a release that includes the fix; the advisory recommends updating to the latest code.
Restrict the use of self‑hosted runners and limit the permissions of the GITHUB_TOKEN by adding explicit permissions restrictions or moving to a machine token with least privileges.
Sanitize and harden GitHub Actions workflow files: remove direct interpolation of untrusted environment variables and enforce strict on‑branch protection rules to prevent malicious pull requests from triggering actions.

Generated by OpenCVE AI on August 4, 2026 at 11:16 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.729% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jh
https://www.vulncheck.com/advisories/wazuh-github-actions-shell-injection-via-fork-pull-request

History

Aug 3, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 2, 2026 12:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`	cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N'}`

Aug 1, 2026 12:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.
Title		Wazuh GitHub Actions Shell Injection via Fork Pull Request
First Time appeared		Wazuh Wazuh wazuh
Weaknesses		CWE-78
CPEs		cpe:2.3:a:wazuh:wazuh::::::::
Vendors & Products		Wazuh Wazuh wazuh
References		https://github.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jh https://www.vulncheck.com/advisories/wazuh-github-actions-shell-injection-via-fork-pull-request
Metrics		cvssV3_1 `{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`