Vulnerability · Published Aug 1, 2026 · Assigned by VulnCheck

CVE-2026-67308Wazuh GitHub Actions Shell Injection via Fork Pull Request

Critical 9.3

In plain English

A critical-severity OS command injection in wazuh from wazuh. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.7%top 45.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.

Affected products (as reported)

Vendor	Product	Versions
wazuh	wazuh	0 – before 44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N

References

GitHub Security Advisory (GHSA-95w2-gpvr-q4jh) vendor-advisory
VulnCheck Advisory: Wazuh GitHub Actions Shell Injection via Fork Pull Request third-party-advisory