CVE-2026-67308 in Workflows
Summary
by MITRE • 08/01/2026
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
This vulnerability exists within Wazuh workflows prior to commit 44bf114 and represents a critical shell injection flaw in the GitHub Actions automation pipeline. The vulnerability specifically targets the processing of VERSION.json files through pull request submissions, where attacker-controlled input is directly interpolated into shell commands without proper sanitization or validation. The flaw occurs when environment variables containing version information are used within run steps, creating an opportunity for malicious command injection that bypasses normal security controls.
The technical implementation of this vulnerability leverages the inherent trust placed in automated workflow processes and the lack of proper input validation within the GitHub Actions configuration files. When a pull request is submitted with a crafted VERSION.json file, the shell interpolation process directly incorporates attacker-controlled content into command execution contexts. This creates a path for arbitrary command execution that can be exploited by malicious actors to gain unauthorized access to system resources and sensitive information.
The operational impact of this vulnerability is severe and multifaceted, particularly when self-hosted runners are involved in the CI/CD pipeline. Attackers can leverage this vulnerability to execute arbitrary commands on the build infrastructure, potentially gaining access to critical secrets such as GITHUB_TOKEN and AWS credentials stored within the runner environment. The exposure of these credentials creates additional attack vectors for lateral movement and persistence within the organization's infrastructure, making this vulnerability particularly dangerous in enterprise environments where automated workflows handle sensitive data processing.
This vulnerability aligns with CWE-78 Shell Injection, which specifically addresses the improper handling of untrusted input in shell command construction, and maps to ATT&CK technique T1059.001 Command and Scripting Interpreter for executing commands through shell environments. The attack pattern follows a typical supply chain compromise approach where attackers manipulate legitimate automation processes to gain unauthorized access to systems and credentials. The vulnerability demonstrates how seemingly benign file processing operations can become critical security weaknesses when proper input validation and sanitization are not implemented.
Mitigation strategies should focus on implementing strict input validation for all automated workflow components, particularly those handling external inputs like VERSION.json files. Organizations should enforce the use of parameterized commands rather than direct shell interpolation, implement proper environment variable sanitization, and ensure that automated workflows operate with minimal required privileges. Additionally, regular auditing of GitHub Actions configurations and implementation of secret scanning tools can help detect and prevent similar vulnerabilities in other parts of the CI/CD pipeline. The fix requires updating the workflow definitions to properly escape or validate any user-supplied input before it is used in shell contexts, effectively closing the attack vector while maintaining the functionality of the automated processes.