Executing arbitrary code in GitHub workflows Wazuh Actions
A critical vulnerability affecting Wazuh's GitHub Actions workflows would allow a malicious actor to execute arbitrary commands on continuous integration environments.
Description
Technical context and vulnerability details
Wazuh is an open source security platform designed for threat detection and incident management. Through its agents, Wazuh collects and analyzes security data, enabling proactive threat detection and rapid incident response. This solution is affected by a vulnerability labeled CVE-2026-67308, resulting from a weakness in the processing of the VERSION.json file. Exploitation of this vulnerability would allow an unauthenticated malicious actor to execute remote commands on affected systems, and potentially access secrets such as GITHUB_TOKEN or AWS credentials stored on affected runners. This vulnerability is classified critical with a severity score of 10.0 according to CVSS v3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Data privacy breach;
- Data integrity breach;
Affected systems
Products, components and targeted versions
- Wazuh workflow before version 44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Wazuh Workflows to version 44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263 incorporating the patch or a later version;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.