What is CVE-2026-67308?

CVE-2026-67308 is a critical-severity vulnerability in Wazuh, classified under OS Command Injection. CVSS score: 10.0/10. Published 2026-08-01.

How severe is CVE-2026-67308?

Critical severity. CVSS v3 base score is 10.0 out of 10.

RCE in Wazuh

CVE-2026-67308

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.005 (44.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Wazuh — versions 0, 44bf114, 44bf114d2f4901aa82ecbb9e5b0780f7c3ca5263

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-67308?: CVE-2026-67308 is a critical-severity vulnerability in Wazuh, classified under OS Command Injection. CVSS score: 10.0/10. Published 2026-08-01.
How severe is CVE-2026-67308?: Critical severity. CVSS v3 base score is 10.0 out of 10.