Critical severity · published Aug 1, 2026
CVE-2026-67308
Wazuh GitHub Actions Shell Injection via Fork Pull Request
9.3
CVSS
0.7%
EPSS
No
On KEV
Description
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
wazuh · wazuh
before 44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-67308
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-67308
github.com
https://github.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jh
www.vulncheck.com
https://www.vulncheck.com/advisories/wazuh-github-actions-shell-injection-via-fork-pull-request
More from wazuh
9.9
CVE-2025-24016
Remote code execution in Wazuh server
9.9
CVE-2026-30893
Wazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer
9.8
CVE-2024-32038
Wazuh is a free and open source platform used for threat prevention, detection, and response
9.8
CVE-2021-44079
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially resulting in remote code execution
9.1
CVE-2026-61800
Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)