CVE-2026-67308
Received Received - Intake

Wazuh Workflows GitHub Actions Shell Injection

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67308
EUVD
EUVD-2026-51853

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wazuh wazuh to 44bf114 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Wazuh workflows before a specific commit contain a shell injection flaw in GitHub Actions. Attackers can exploit this by submitting pull requests with malicious VERSION.json files. The vulnerability allows command execution through shell metacharacters injected into environment variables, which are then used in workflow run steps.

Impact Analysis

If you use Wazuh workflows with self-hosted GitHub Actions runners, attackers could execute arbitrary commands on your systems. This could lead to theft of sensitive data like GITHUB_TOKEN and AWS credentials, unauthorized code execution, or further compromise of your infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Update Wazuh workflows to version 44bf114 or later to address the shell injection vulnerability. Review GitHub Actions workflows for VERSION.json file handling and ensure environment variables are properly sanitized to prevent command injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67308. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart