{"id":"CVE-2026-67308","state":"PUBLISHED","title":"Wazuh GitHub Actions Shell Injection via Fork Pull Request","description":"Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.","publishedAt":"2026-08-01T12:22:17.146Z","updatedAt":"2026-08-03T19:35:25.948Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["wazuh wazuh"],"affected":[{"vendor":"wazuh","product":"wazuh","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263","versionType":"git"},{"version":"44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263","status":"unaffected","versionType":"git"}]}],"references":["https://github.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jh","https://www.vulncheck.com/advisories/wazuh-github-actions-shell-injection-via-fork-pull-request"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/67xxx/CVE-2026-67308.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-67308","state":"PUBLISHED","datePublished":"2026-08-01T12:22:17.146Z","dateUpdated":"2026-08-03T19:35:25.948Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-07-29T13:06:35.178Z"},"containers":{"cna":{"title":"Wazuh GitHub Actions Shell Injection via Fork Pull Request","descriptions":[{"lang":"en","value":"Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners."}],"affected":[{"vendor":"wazuh","product":"wazuh","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263","versionType":"git"},{"version":"44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263","status":"unaffected","versionType":"git"}]}],"references":[{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jh","tags":["vendor-advisory"],"name":"GitHub Security Advisory (GHSA-95w2-gpvr-q4jh)"},{"url":"https://www.vulncheck.com/advisories/wazuh-github-actions-shell-injection-via-fork-pull-request","name":"VulnCheck Advisory: Wazuh GitHub Actions Shell Injection via Fork Pull Request","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","baseScore":9.3,"baseSeverity":"CRITICAL"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","lang":"en","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-08-02T11:57:34.365Z"},"datePublic":"2026-07-16T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"cybermukesh","type":"reporter"},{"lang":"en","value":"Miguevrgo","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jh","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-03T19:35:04.618989Z","id":"CVE-2026-67308","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-03T19:35:25.948Z"}}]}}}