Critical Shell Injection Hits Wazuh Workflows

Wazuh workflows prior to version 44bf114 contain a critical shell injection vulnerability within their GitHub Actions implementation. This flaw, identified as CVE-2026-67308, carries a maximum CVSS score of 10 and enables remote attackers to execute arbitrary commands by submitting pull requests containing malicious VERSION.json files.

What's at Risk

The vulnerability affects users of Wazuh utilizing GitHub Actions for automation. Organizations that rely on self-hosted runners are at the highest risk, as the flaw allows attackers to exfiltrate sensitive secrets, including the GITHUB_TOKEN and AWS credentials, directly from the host environment.

Because the vulnerability can be triggered via a public pull request, any project using these workflows is potentially exposed to unauthorized command execution. This risk is compounded for teams that grant their automation runners broad access to cloud environments or internal infrastructure, as a successful exploit effectively grants the attacker the same permissions as the runner itself.

How the Flaw Works

Shell injection occurs when an application passes untrusted input—such as data from a pull request—directly to a system shell without proper sanitization. In general, this class of vulnerability allows an attacker to break out of the intended command context by injecting shell metacharacters. Once the shell interprets these characters as instructions rather than data, the attacker can chain commands together to perform unauthorized actions.

In the context of CI/CD pipelines, this typically means that environment variables or configuration files are being interpolated into shell scripts in an unsafe manner. By manipulating these inputs, an attacker can force the runner to execute arbitrary code with the privileges of the CI/CD service account. This is a common pattern in insecure automation workflows where external input is treated as a trusted variable rather than potentially malicious text.

How to Protect Your Systems

• Update Wazuh workflows immediately to version 44bf114 or later to eliminate the vulnerable code path.
• Audit your self-hosted runner logs for any suspicious pull request activity or unexpected command execution.
• Restrict the permissions of your CI/CD service accounts to follow the principle of least privilege, ensuring they only have access to the resources required for their specific tasks.
• Implement strict input validation and sanitization for all files processed by automation workflows, particularly those that originate from external contributors.
• Rotate any secrets, including AWS keys and GitHub tokens, that may have been exposed on runners that processed untrusted pull requests prior to the patch.

Given the critical severity of this vulnerability and the potential for full system compromise, organizations should prioritize patching as an immediate security imperative. Relying on vulnerable automation workflows leaves your CI/CD pipeline open to exploitation, which can lead to the silent exfiltration of environment secrets and long-term persistence within your infrastructure.