CVE-2025-15617 Wazuh CVE debrief

Who should care

Defenders responsible for Wazuh deployments, GitHub Actions workflows, and software supply chain security should assess exposure and implement mitigations. This includes verifying Wazuh version 4.12.0 deployments, limiting access to GITHUB_TOKEN, and monitoring for suspicious activity related to Wazuh workflow run artifacts. Security teams should prioritize vulnerability management and ensure secure configurations for Wazuh deployments.

Why it matters

CVE-2025-15617 is a high-severity vulnerability in Wazuh version 4.12.0 that exposes GitHub Actions workflow artifacts, allowing attackers to extract the GITHUB_TOKEN and perform unauthorized actions within a limited time window. Defenders should prioritize verifying Wazuh deployments, assessing exposure, and implementing compensating controls.

• Verify Wazuh version 4.12.0 deployments for exposure of GitHub Actions workflow artifacts
• Limit access to GITHUB_TOKEN to prevent unauthorized actions
• Monitor for suspicious activity related to Wazuh workflow run artifacts
• Implement compensating controls to mitigate unauthorized actions

Technical summary

The vulnerability in Wazuh version 4.12.0 exposes GitHub Actions workflow artifacts, allowing attackers to extract the GITHUB_TOKEN. This token can be used within a limited time window to perform unauthorized actions such as pushing malicious commits or altering release tags. The vulnerability affects Wazuh deployments that use GitHub Actions, and defenders should prioritize verifying Wazuh version 4.12.0 deployments, assessing exposure of GitHub Actions workflow artifacts, and implementing compensating controls to mitigate unauthorized actions.

Defensive priority

Defenders should prioritize verifying Wazuh version 4.12.0 deployments, assessing exposure of GitHub Actions workflow artifacts, and implementing compensating controls to mitigate unauthorized actions.

Recommended defensive actions

• Verify Wazuh version 4.12.0 deployments for exposure of GitHub Actions workflow artifacts
• Assess and limit access to GITHUB_TOKEN
• Implement compensating controls to mitigate unauthorized actions
• Monitor for suspicious activity related to Wazuh workflow run artifacts
• Review Wazuh workflow configurations for potential security risks
• Conduct a thorough review of Wazuh deployment configurations to ensure secure use of GitHub Actions
• Track exceptions and retest remediated assets to ensure vulnerability resolution

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but evidence is limited regarding affected deployments, exploitation, and remediation. Defenders should verify Wazuh version 4.12.0 deployments for exposure of GitHub Actions workflow artifacts, limit access to GITHUB_TOKEN, and monitor for suspicious activity related to Wazuh workflow run artifacts. Evidence limits and source grounding indicate a need for further verification and assessment of potential impacts on Wazuh deployments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.