CVE-2026-67308

Summary

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.

Affected Software

VendorProductVersion RangeStatus
wazuhwazuh0 < 44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263affected
wazuhwazuh44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263unaffected

Weaknesses

  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: total

Additional References

References