by Kastro
Paper/Archive/CVE-2026-67308

CVE-2026-67308

wazuh wazuh — Wazuh GitHub Actions Shell Injection via Fork Pull Request

EPSS 0.7%public exploitCVSS 9.3
critical.is priorityof 100
49
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 54.3.543 × 2010.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.

Affected

ProductAffectedFixed inSource
wazuh< 44bf114d2f4901aa82ecbb9e5b0780f7c3ca526344bf114d2f4901aa82ecbb9e5b0780f7c3ca5263CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jhwriteupvulncheck.com/advisories/wazuh-github-actions-shell-injection-via-fork-pull-request