CVE-2026-67308

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-67308", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-29T13:06:35.178Z", "datePublished": "2026-08-01T12:22:17.146Z", "dateUpdated": "2026-08-03T19:35:25.948Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-02T11:57:34.365Z"}, "datePublic": "2026-07-16T00:00:00.000Z", "title": "Wazuh GitHub Actions Shell Injection via Fork Pull Request", "descriptions": [{"lang": "en", "value": "Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "cweId": "CWE-78", "type": "CWE"}]}], "affected": [{"vendor": "wazuh", "product": "wazuh", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "git", "lessThan": "44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263"}, {"version": "44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263", "status": "unaffected", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL"}}], "references": [{"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jh", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-95w2-gpvr-q4jh)"}, {"name": "VulnCheck Advisory: Wazuh GitHub Actions Shell Injection via Fork Pull Request", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/wazuh-github-actions-shell-injection-via-fork-pull-request"}], "credits": [{"lang": "en", "value": "cybermukesh", "type": "reporter"}, {"lang": "en", "value": "Miguevrgo", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jh", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-03T19:35:04.618989Z", "id": "CVE-2026-67308", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T19:35:25.948Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-67308", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-03T19:35:04.618989Z"}}}], "references": [{"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jh", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T19:35:20.024Z"}}], "cna": {"title": "Wazuh GitHub Actions Shell Injection via Fork Pull Request", "credits": [{"lang": "en", "type": "reporter", "value": "cybermukesh"}, {"lang": "en", "type": "finder", "value": "Miguevrgo"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "wazuh", "product": "wazuh", "versions": [{"status": "affected", "version": "0", "lessThan": "44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263", "versionType": "git"}, {"status": "unaffected", "version": "44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263", "versionType": "git"}], "defaultStatus": "unaffected"}], "datePublic": "2026-07-16T00:00:00.000Z", "references": [{"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jh", "name": "GitHub Security Advisory (GHSA-95w2-gpvr-q4jh)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/wazuh-github-actions-shell-injection-via-fork-pull-request", "name": "VulnCheck Advisory: Wazuh GitHub Actions Shell Injection via Fork Pull Request", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-02T11:57:34.365Z"}}}, "cveMetadata": {"cveId": "CVE-2026-67308", "state": "PUBLISHED", "dateUpdated": "2026-08-03T19:35:25.948Z", "dateReserved": "2026-07-29T13:06:35.178Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-01T12:22:17.146Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "wazuh", "vendor": "wazuh", "versions": [{"lessThan": "44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263", "status": "affected", "version": "0", "versionType": "git"}, {"status": "unaffected", "version": "44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263", "versionType": "git"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners."}], "id": "CVE-2026-67308", "lastModified": "2026-09-09T20:26:18.573", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67308", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-03T19:35:04.618989Z", "version": "2.0.3"}}]}, "published": "2026-08-01T13:17:00.553", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jh"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/wazuh-github-actions-shell-injection-via-fork-pull-request"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jh"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,44bf114)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "44bf114"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "wazuh", "source": "cna", "vendor": "wazuh"}, "product": "wazuh", "vendor": "wazuh"}], "created": "2026-08-01T14:30:05.934846+00:00", "updated": "2026-08-04T11:30:07.135951+00:00", "vendors": ["wazuh", "wazuh$PRODUCT$wazuh"]}