CVE-2026-67308: Wazuh Workflows Shell Injection

How to Detect It

Detection for this CVE is about identifying suspicious workflow executions and malicious pull request content rather than scanning a network service. Start by reviewing GitHub Actions runs triggered by fork-originated pull requests that touched VERSION.json or related build metadata files. Pay special attention to jobs that unexpectedly spawned shell utilities used in exfiltration or environment discovery, such as curl, wget, env, printenv, aws, or calls to external domains not normally contacted by your pipelines.

You should also inspect self-hosted runner logs for anomalous command lines and outbound connections during pull request validation jobs. Because the described impact includes theft of GITHUB_TOKEN and AWS credentials, any workflow run that prints environment variables, accesses AWS APIs unexpectedly, or makes suspicious outbound HTTP requests during PR processing deserves urgent review. If logs are incomplete, assume higher risk and rotate credentials exposed to the affected workflow context.

Technical Notes

A simple repository history check for suspicious pull requests modifying VERSION.json:

git log --all --name-only --pretty=format:'commit %H %ad %an %s' -- VERSION.json

Example shell-history or runner-log indicators to search for:

VERSION.json
GITHUB_TOKEN
AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY
printenv
env
curl http
wget http
bash -c
sh -c

Example grep against self-hosted runner diagnostic logs:

grep -RInE 'VERSION\.json|GITHUB_TOKEN|AWS_ACCESS_KEY_ID|printenv|curl |wget |bash -c|sh -c' /path/to/actions-runner/_diag/

Example GitHub Actions hunting query logic to apply in your SIEM or log pipeline:

Find workflow runs where:
- event_name = pull_request OR pull_request_target
- changed_files contains "VERSION.json"
- runner_type = self-hosted
- step logs contain "curl", "wget", "printenv", "aws sts", or unexpected external domains

If you lack centralized CI logging, export and retain job logs now. CI incidents are often discovered after secrets have already been used elsewhere.

Mitigation and Patching

The documented fix boundary is commit 44bf114. Because the available source material does not provide a formal released software version number, the safest guidance is to update the affected workflow definitions so that your repository includes commit 44bf114 or a later revision. If you vendor or copy upstream workflow files into internal repositories, update those copies as well; simply upgrading Wazuh runtime components will not necessarily remediate a workflow logic flaw.

If immediate patching is not possible, reduce exposure by limiting what untrusted pull requests can trigger. Review whether workflows triggered by pull_request or pull_request_target run with secrets, write permissions, or access to self-hosted runners. Remove or restrict sensitive secrets from these contexts, isolate self-hosted runners used for untrusted code, and require stricter validation of values parsed from VERSION.json or similar metadata files. If compromise is suspected, rotate GITHUB_TOKEN, AWS credentials, and any other secrets reachable from the runner.

Technical Notes

To update a local clone and verify the fix commit is present:

git fetch origin
git checkout main
git pull --ff-only
git merge-base --is-ancestor 44bf114 HEAD && echo "fixed" || echo "update required"

If you maintain a fork and need to cherry-pick the fix:

git fetch upstream
git cherry-pick 44bf114

To harden workflows while patching, validate VERSION.json values before use:

- name: Validate VERSION.json fields
  run: |
    VERSION=$(jq -r '.version' VERSION.json)
    echo "$VERSION" | grep -Eq '^[0-9A-Za-z._-]+$' || {
      echo "Invalid version format"
      exit 1
    }

To reduce risk on GitHub Actions, review event triggers and secret exposure. For example, do not expose sensitive secrets to untrusted PR contexts unless absolutely necessary. If self-hosted runners process public contributions, segment them from internal networks and use short-lived credentials wherever possible.

References

The primary public reference is the NVD record for CVE-2026-67308, which provides the verified description, publication date, and severity. That description is the basis for the shell injection characterization and the specific warning about VERSION.json, command execution, and exfiltration of GITHUB_TOKEN and AWS credentials on self-hosted runners.

Upstream and third-party references also help defenders validate scope and remediation direction. The GitHub Security Advisory URL is the vendor-hosted disclosure path referenced by NVD, and the VulnCheck advisory reinforces the attack theme of shell injection via fork pull request handling. Because the available source material does not include a formal release number for the fix, defenders should rely on the documented commit boundary rather than assume a package version.

• NVD CVE record: https://nvd.nist.gov/vuln/detail/CVE-2026-67308
• GitHub Security Advisory: https://github.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jh
• VulnCheck advisory: https://www.vulncheck.com/advisories/wazuh-github-actions-shell-injection-via-fork-pull-request
• Wazuh official site: https://wazuh.com
• Wazuh upstream repository: https://github.com/wazuh/wazuh

In short, CVE-2026-67308 is a critical CI/CD security issue centered on unsafe shell interpolation in Wazuh workflows before commit 44bf114. Even without confirmed in-the-wild exploitation, the combination of arbitrary command execution and possible secret theft on self-hosted runners is enough to justify urgent action.

For more information on securing service accounts, refer to our article on securing service accounts in Active Directory. Additionally, you can learn about best practices for home network segmentation in our home network segmentation best practices article.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.