CVE-2026-67308 Details
Description
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.
A shell injection vulnerability has been identified in Wazuh workflows prior to version 44bf114. This vulnerability exists within GitHub Actions and allows attackers to execute arbitrary commands by submitting pull requests with manipulated VERSION.json files. The injected shell metacharacters are introduced into environment variables, which are then directly interpolated into run steps. This exploitation enables command execution and the exfiltration of sensitive secrets, such as GITHUB_TOKEN and AWS credentials, on self-hosted runners.
Wazuh has not yet patched this vulnerability. However, an immediate fix is to validate the VERSION.json content before writing to the GITHUB_ENV variable. A comprehensive solution is to use environment variables instead of expressions in the run steps, following GitHub's security hardening guidelines.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 2, 2026 | CVE Modified | [email protected] |
| Aug 1, 2026 | New CVE Received | [email protected] |