Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-67308: Wazuh GitHub Actions allows attackers to execute arbitrary commands
CVE-2026-67308
CVE-2026-67308
Summary
Wazuh's GitHub Actions workflows have a security flaw that can be exploited by attackers. If an attacker submits a specific type of file through a pull request, they can execute unauthorized commands on Wazuh's systems. To fix this, update Wazuh's GitHub Actions workflows to version 44bf114 or later.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wazuh | wazuh |
< 44bf114 < 44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263 |
Original title
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json fi...
Original description
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.
mitre CVSS3.1
10.0
Vulnerability type
CWE-78
OS Command Injection
Published: 1 Aug 2026 · Updated: 4 Aug 2026 · First seen: 1 Aug 2026