External risk intelligence

Wazuh GitHub Actions Shell Injection Via Crafted VERSION.json

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-67308

The vulnerability exists within a build-time process involving GitHub Actions workflows. It is triggered by pull request submission during development and testing activities, rather than being a public-facing application, service, or network-accessible endpoint in a standard production deployment.

OS Command Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability within Wazuh's GitHub Actions workflows that could allow unauthorized command execution. The issue stems from how version information is processed, potentially enabling attackers to compromise systems, especially those using self-hosted runners. Verifying the scope and impact of this vulnerability within your environment is the primary concern.

Unsafe processing of version files allows command execution.
Key concern: Confirming relevance and exposure.
Mitigate potential risks by verifying system exposure.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by submitting a pull request containing a malicious `VERSION.json` file, which leverages a weakness in GitHub Actions used by Wazuh workflows. This allows them to inject commands through environment variables, potentially leading to unauthorized command execution and the theft of sensitive information.

Requires submitting a pull request.
Triggered by crafted JSON file.
Risk of command execution and data theft.

Live Threat

Current exploitation, exposure, and threat context

Attackers could execute arbitrary commands on self-hosted runners by submitting pull requests with specially crafted `VERSION.json` files. This could lead to the exfiltration of sensitive information, such as secrets, when supported by the advisory and when these workflows are processed.

System secrets and credentials.
Crafted pull requests and workflow execution.
Unauthorized access and data exfiltration.

Operational Fix

Recommended remediation, mitigation, and detection steps

Wazuh workflows are susceptible to shell injection via crafted `VERSION.json` files in pull requests, potentially leading to arbitrary command execution and secret exfiltration on self-hosted runners. The first practical step is to identify all instances of the affected Wazuh workflows, confirm their exposure and criticality, and locate the responsible owner for remediation planning.

Application and platform teams own resolution.
Verify self-hosted runner exposure and workflow usage.
Coordinate vendor engagement and plan maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Wazuh and how does it use GitHub Actions?

Wazuh is an open-source security platform designed for threat detection, integrity monitoring, and incident response. It utilizes GitHub Actions—a CI/CD automation tool—to streamline its development processes, such as automating tests and building software releases whenever code changes are pushed or pull requests are submitted to the project.

What does CVE-2026-67308 mean by shell injection?

This vulnerability, classified as CWE-78 (OS Command Injection), occurs when a program takes untrusted input and uses it to construct a system command without proper sanitization. In this case, the workflow processes a VERSION.json file, allowing an attacker to insert malicious shell characters. The system misinterprets these characters as commands, executing them with the privileges of the runner environment.

How is this vulnerability triggered?

The flaw is triggered when a pull request containing a specially crafted VERSION.json file is submitted to a repository using the affected Wazuh workflows. It does not trigger during standard, benign development activities or through normal usage of the Wazuh platform itself; it specifically requires the submission of this modified configuration file to initiate the unintended command execution.

Is my organization at risk according to Halo Surface Signal?

Halo Surface Signal indicates that this vulnerability is very unlikely to pose a traditional network-facing threat. Because the flaw exists within a build-time development process rather than a public-facing application, the risk is largely confined to the environments where these specific GitHub Actions workflows are executed, particularly those utilizing self-hosted runners.

How do I secure my infrastructure against this issue?

The most effective first step is to identify all repositories or build pipelines that rely on the affected Wazuh workflows. Once identified, confirm if these workflows are running on self-hosted runners, as these are the primary targets for secret exfiltration. Coordinate with your development and platform teams to verify if your workflows are updated to the secure version specified by the project maintainers.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.