Skip to content
Threat Feed
Subscribe
critical advisory

Wazuh GitHub Actions Shell Injection Vulnerability

A shell injection vulnerability in Wazuh workflows allows unauthenticated attackers to execute arbitrary commands and exfiltrate secrets via malicious pull requests containing crafted VERSION.json files.

Wazuh workflows prior to commit 44bf114 contain a critical shell injection vulnerability (CVE-2026-67308) in their GitHub Actions CI/CD pipeline. The flaw exists because the workflow improperly neutralizes shell metacharacters within the VERSION.json file before interpolating them into active shell command execution steps. By submitting a pull request containing a crafted VERSION.json file, an attacker can influence environment variables used by the runner. This results in arbitrary command execution on self-hosted runners. Because these runners often possess elevated privileges to interact with cloud infrastructure, successful exploitation enables the exfiltration of sensitive secrets, including the GITHUB_TOKEN and embedded AWS credentials. This vulnerability represents a significant risk to the integrity of the CI/CD pipeline and the underlying infrastructure managed by the affected Wazuh instances.

Attack Chain

  1. The attacker identifies a target repository using vulnerable Wazuh CI/CD workflows.
  2. The attacker creates a fork of the Wazuh repository or initiates a pull request.
  3. The attacker crafts a malicious VERSION.json file containing shell metacharacters (e.g., backticks, semicolon, or command redirection).
  4. The attacker submits the pull request to the upstream repository.
  5. The automated GitHub Actions CI/CD pipeline triggers upon the pull request submission.
  6. The workflow process reads and interpolates the contents of the malicious VERSION.json file into a shell execution context.
  7. The attacker-supplied commands execute with the privileges of the GitHub Action runner environment.
  8. The injected code identifies and exfiltrates sensitive environment variables such as GITHUB_TOKEN or AWS credentials to an attacker-controlled server.

Impact

Successful exploitation allows for complete compromise of the self-hosted runner environment. This permits unauthorized access to cloud-provider secrets, potential lateral movement into the build infrastructure, and the ability to inject malicious code into downstream software releases or internal tools, impacting the integrity of the Wazuh supply chain.

Recommendation

  1. Upgrade all Wazuh workflow configurations to the version identified by commit 44bf114 or later to remediate CVE-2026-67308.
  2. Audit self-hosted runner logs for unusual process execution patterns immediately following pull request events.
  3. Rotate all credentials and tokens that were potentially accessible to the GitHub Actions runner environment, specifically targeting AWS IAM keys and GITHUB_TOKEN values.
  4. Restrict permissions for self-hosted runners and implement OIDC (OpenID Connect) for cloud provider authentication to reduce the blast radius of potential secret exfiltration.