SYS::ONLINE
Wasteland.
Briefs1653
Issues21
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-67308 2026-08-01

CVE-2026-67308: Shell Injection in Wazuh GitHub Actions Workflows

"A shell injection flaw in Wazuh's GitHub Actions workflows lets attackers execute arbitrary commands and steal CI secrets by opening a pull request with a crafted `VERSION.json` file."

A shell injection flaw in Wazuh's GitHub Actions workflows lets attackers execute arbitrary commands and steal CI secrets by opening a pull request with a crafted VERSION.json file.

What Is It

Wazuh workflows before commit 44bf114 contain a shell injection vulnerability (CWE-78, OS Command Injection) in their GitHub Actions configuration. Values read from a pull request's VERSION.json file are expanded into the shell script of a run step through GitHub Actions ${{ }} expression substitution, which happens before the script is handed to the shell. Because the substitution is textual and unquoted, shell metacharacters supplied by the attacker become part of the command the runner executes rather than data it operates on.

The issue was disclosed by VulnCheck and published to NVD on 2026-08-01, where it currently carries a status of "Received"; meaning NVD has ingested the record but has not yet performed its own analysis.

Why It Matters

The attack requires no authentication and no privileges; anyone able to open a pull request against the repository can trigger it. VulnCheck, as the assigning CNA, supplies a CVSS 3.1 base score of 10.0 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, reflecting a scope change and high impact to confidentiality, integrity, and availability. Because the CVE remains in "Received" status, NVD has published no independent score of its own; the figures below are CNA-supplied and should be read as the reporter's assessment rather than an NVD-adjudicated one.

Beyond command execution, the advisory specifically calls out exfiltration of CI/CD secrets, including GITHUB_TOKEN and AWS credentials, from self-hosted runners. That turns a repository-level bug into a potential foothold in the build infrastructure behind it.

Note the divergence in scoring within the CNA's own record: a secondary CVSS 4.0 assessment rates it 5.3 (MEDIUM), with passive user interaction and only low confidentiality impact. Defenders should weigh both, but the secrets-exfiltration path on self-hosted runners argues for treating this urgently, and for revisiting the severity once NVD completes its analysis.

What's Vulnerable

No CPE entries have been published for this CVE yet, consistent with its pre-analysis status. The vulnerable component is the workflow configuration itself, not the Wazuh agent or manager runtime.

Patch Status

A fix is available. Commit 44bf114 is marked unaffected; organizations running forks or self-hosted mirrors of the Wazuh repository, particularly those using self-hosted runners, should update to that commit or later. Rotating any GITHUB_TOKEN and AWS credentials exposed to the affected workflows is a prudent follow-up.

This CVE does not appear in the CISA KEV catalog in the supplied data; there is no confirmation of active exploitation, and no KEV-mandated remediation deadline applies.

Sources