CVE-2026-67308
Wazuh GitHub Actions Shell Injection via Fork Pull Request
- State
- Published
- Severity
- 9.3 Critical
- Published
- Aug 1, 2026
- Updated
- Aug 3, 2026
- Reserved
- Jul 29, 2026
Description
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N | VulnCheck |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
wazuhwazuh |
|
References
- GitHub Security Advisory (GHSA-95w2-gpvr-q4jh)vendor-advisory
- VulnCheck Advisory: Wazuh GitHub Actions Shell Injection via Fork Pull Requestthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.