Vulnerability Intelligence Report
Wazuh GitHub Actions Shell Injection via Fork Pull Request
CVE-2026-67308
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.
Injection
No Active Exploit Signals
CVSS Base Score
9.3
CRITICAL
EPSS Probability:0.45%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-78 ↗Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| wazuh | wazuh | 0 < 44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263 (affected), 44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263 (unaffected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VulnCheck · Bug Bounty Provider · USA |
| Reserved | 2026-07-29T13:06:35 |
| Published | 2026-08-01T12:22:17 |
| Patch Date | 2026-07-16 |
| Last Updated | 2026-08-03T19:35:25 |
Community Chatter & Buzz