CVE-2026-67308 wazuh CVE debrief

Who should care

Security teams and administrators responsible for Wazuh workflows and GitHub Actions should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating Wazuh workflows to version 44bf114 or later, implementing input validation and sanitization for VERSION.json files, monitoring GitHub Actions for suspicious activity, restricting access to self-hosted runners, and rotating credentials for GITHUB_TOKEN and AWS. Additionally, security teams should review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, retest remediated assets, and close the item only after evidence is documented. Affected operators, platforms, and vulnerability-management teams should also be informed of the potential impact and review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Security teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and check relevant monitoring, detection, and logs for exposed assets that need extra review. Asset inventory and source tracking should also be reviewed to ensure that all affected systems are accounted for and that the vulnerability is properly tracked and managed. Finally, security teams should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. This should be done with a focus on defensive impact and source-grounded technical framing, without unsupported root-cause or exploit claims. The goal is to ensure that all necessary steps are taken to mitigate the vulnerability and prevent potential attacks. This includes reviewing the vulnerability class, likely operational impact, and source-confidence limits, as well as the review context. By taking these steps, security teams can help prevent the exploitation of this vulnerability and protect their systems from potential attacks. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM, indicating a moderate level of risk. However, the potential impact of the vulnerability is significant, as it could allow attackers to execute 7

Technical summary

The vulnerability exists in Wazuh workflows before version 44bf114, where a shell injection vulnerability in GitHub Actions allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.

Defensive priority

Medium priority given the CVSS score of 5.3 and the potential for attackers to execute arbitrary commands.

Recommended defensive actions

• Review and update Wazuh workflows to version 44bf114 or later
• Implement input validation and sanitization for VERSION.json files
• Monitor GitHub Actions for suspicious activity
• Restrict access to self-hosted runners
• Rotate credentials for GITHUB_TOKEN and AWS

Evidence notes

The vulnerability exists in Wazuh workflows before version 44bf114, where a shell injection vulnerability in GitHub Actions allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Evidence is limited, and further verification is required to determine the full scope of affected systems and potential mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.