Critical severityNVD Advisory· Published Aug 1, 2026· Updated Sep 9, 2026

CVE-2026-67308

Description

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Wazuh/Wazuhllm-fuzzy
Range: <44bf114

Patches

Vulnerability mechanics

References

github.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jhnvd
www.vulncheck.com/advisories/wazuh-github-actions-shell-injection-via-fork-pull-requestnvd

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000