CVE-2026-67308: Wazuh GitHub Actions Shell Injection via Fork Pull Request
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUBTOKEN and AWS credentials on self-hosted runners.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuh GitHub Actions workflowsto a version that resolves this vulnerability.Patch 44bf114
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67308?
CVE-2026-67308 has a critical severity rating of 10.
How do I fix CVE-2026-67308?
To fix CVE-2026-67308, upgrade Wazuh workflows to a version after 44bf114.
What type of vulnerability is CVE-2026-67308?
CVE-2026-67308 is classified as an OS Command Injection vulnerability.
What can attackers do with CVE-2026-67308?
Attackers can execute arbitrary commands through shell injection by submitting crafted pull requests containing manipulated VERSION.json files.
Which software is affected by CVE-2026-67308?
CVE-2026-67308 affects Wazuh workflows before the commit 44bf114.