CVE-2026-67308: Wazuh Workflows RCE Vulnerability

CVE-2026-67308 Overview

CVE-2026-67308 is a shell injection vulnerability in Wazuh GitHub Actions workflows before commit 44bf114. The flaw resides in workflow logic that interpolates untrusted content from VERSION.json files directly into run steps. Attackers submit a pull request from a fork containing crafted values, and the workflow executes attacker-controlled shell commands on self-hosted runners. Successful exploitation exposes GITHUB_TOKEN, AWS credentials, and any other secrets available to the runner. The vulnerability is tracked as CWE-78: OS Command Injection.

Critical Impact
Attackers with no prior access can execute arbitrary commands on Wazuh self-hosted CI runners and exfiltrate GITHUB_TOKEN and AWS credentials by opening a pull request.

Affected Products

Wazuh GitHub Actions workflows before commit 44bf114
Self-hosted GitHub Actions runners configured to execute Wazuh CI workflows
CI pipelines that consume VERSION.json from pull request source branches

Discovery Timeline

2026-08-01 - CVE-2026-67308 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67308

Vulnerability Analysis

The vulnerability is a classic GitHub Actions shell injection pattern. Wazuh workflows read fields from a VERSION.json file supplied by the pull request head branch. Those fields are assigned into workflow environment variables and then interpolated into run: blocks using ${{ ... }} expression syntax. GitHub Actions substitutes the expression before the shell parses the command, so any shell metacharacters in the JSON value become part of the executed command line.

Because the workflow triggers on pull_request and runs on self-hosted runners, an attacker forks the repository, modifies VERSION.json to include shell payloads, and opens a pull request. The runner executes the injected commands with access to workflow secrets, including GITHUB_TOKEN and configured AWS credentials.

Root Cause

The root cause is unsafe interpolation of attacker-controlled data into shell commands within GitHub Actions run steps. Values sourced from a fork-controlled file are treated as trusted input rather than passed through the environment as quoted variables. See the GitHub Security Advisory GHSA-95w2-gpvr-q4jh for the affected workflow references.

Attack Vector

Exploitation requires only that an attacker open a pull request from a fork. The attacker crafts VERSION.json so that a targeted field contains shell metacharacters such as command substitution or command chaining sequences. When the vulnerable workflow runs, the injected payload executes on the self-hosted runner with the workflow's secret context. The attacker can then print secrets to logs, POST them to an external host, or push code using the acquired GITHUB_TOKEN. Full technical detail is available in the VulnCheck Advisory.

Detection Methods for CVE-2026-67308

Indicators of Compromise

Pull requests from forks that modify VERSION.json and contain shell metacharacters such as `, $(, ;, &&, or | in field values
Self-hosted runner processes spawning curl, wget, nc, or shell one-liners that reference GITHUB_TOKEN, AWS_ACCESS_KEY_ID, or AWS_SECRET_ACCESS_KEY
Outbound network connections from runner hosts to unrecognized destinations during workflow execution
Unexpected use of GITHUB_TOKEN to push branches, create releases, or modify repository settings

Detection Strategies

Inspect workflow run logs for run: steps whose expanded command line contains characters that were not present in the workflow source
Alert on GitHub audit log events where pull_request workflows on self-hosted runners are triggered by first-time external contributors
Correlate runner process telemetry with environment variable access, flagging reads of secret-bearing variables followed by network egress

Monitoring Recommendations

Forward self-hosted runner endpoint telemetry, including process, command line, and network connection events, into a centralized analytics platform
Monitor GitHub Actions audit logs for workflow modifications and for pull requests that touch files consumed by CI, such as VERSION.json
Track AWS CloudTrail for API calls originating from credentials scoped to CI, flagging use from unexpected source IP ranges

How to Mitigate CVE-2026-67308

Immediate Actions Required

Update Wazuh workflows to commit 44bf114 or later and confirm the fix is present on all branches referenced by pull_request triggers
Rotate any secrets exposed to affected workflows, including GITHUB_TOKEN scopes, deploy keys, and AWS access keys used by the runners
Audit recent pull requests from forks that modified VERSION.json and review corresponding runner logs for signs of command injection
Restrict self-hosted runners so they do not execute workflows from fork pull requests by default, using GitHub's Require approval for all outside collaborators setting

Patch Information

The fix is available in Wazuh workflow commit 44bf114. Consult the GitHub Security Advisory GHSA-95w2-gpvr-q4jh for the patched workflow definitions and any backport guidance.

Workarounds

Move fork pull request builds off self-hosted runners and onto ephemeral GitHub-hosted runners with no privileged secrets
Refactor vulnerable run steps to pass untrusted data through an intermediate environment variable and reference it with shell-quoted "$VAR" syntax instead of ${{ }} expression interpolation
Validate VERSION.json values against a strict allowlist, such as semantic version regex, before any downstream workflow step consumes them
Require maintainer approval before workflows execute for pull requests from first-time or external contributors

bash

# Configuration example: safe handling of untrusted workflow input
# Pass the value through env, then reference it as a quoted shell variable.
- name: Read version safely
  env:
    PR_VERSION: ${{ steps.read_version.outputs.value }}
  run: |
    if ! printf '%s' "$PR_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
      echo "Invalid version string" >&2
      exit 1
    fi
    echo "Building version: $PR_VERSION"