EUVD-2025-209105
GHSA-r33m-965m-8chx
CVSS Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3Description
Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOKEN from uploaded artifacts. Attackers can use the exposed token within a limited time window to perform unauthorized actions such as pushing malicious commits or altering release tags.
Analysis
GitHub Actions workflow artifacts in Wazuh version 4.12.0 expose GITHUB_TOKEN credentials that unauthenticated network attackers can extract and use within a limited time window to push malicious commits or alter release tags in the project repository. The vulnerability carries a CVSS 4.0 score of 8.3 with high integrity impact and low availability impact. No public exploit identified at time of analysis, though the vulnerability is classified under authentication bypass tags by VulnCheck.
Technical Context
This vulnerability stems from CWE-522 (Insufficiently Protected Credentials), where GitHub Actions workflow execution results in GITHUB_TOKEN secrets being inadvertently included in uploaded artifacts. The affected product is cpe:2.3:a:wazuh:wazuh:4.12.0 based on version specificity. GitHub Actions automatically provisions short-lived GITHUB_TOKEN credentials with repository-scoped permissions for workflow runs. When these tokens are captured in artifacts (logs, build outputs, or other uploaded files), they become accessible to anyone who can download the artifact before token expiration. The token's permissions typically include repository write access, enabling modification of code, tags, and releases. This exposure transforms a CI/CD security boundary into an attack vector for supply chain compromise.
Affected Products
Wazuh version 4.12.0 is confirmed affected based on the CVE description and vendor security advisory available at https://github.com/wazuh/wazuh/security/advisories/GHSA-6xqr-4q5g-xc7x. The vulnerability specifically impacts the GitHub Actions CI/CD workflow configuration used by the Wazuh project repository rather than the deployed Wazuh security platform itself. Organizations using Wazuh 4.12.0 binaries should verify artifact integrity against published checksums and monitor for unexpected repository changes during the exposure window. VulnCheck has published additional analysis at https://www.vulncheck.com/advisories/exposure-of-the-github-token-in-wazuh-workflow-run-artifact.
Remediation
Review the vendor security advisory at https://github.com/wazuh/wazuh/security/advisories/GHSA-6xqr-4q5g-xc7x for specific remediation guidance. The fix likely involves modifying GitHub Actions workflow configurations to prevent GITHUB_TOKEN inclusion in artifacts through environment variable sanitization, artifact filtering, or workflow permission restrictions. Organizations consuming Wazuh releases should verify the integrity of version 4.12.0 artifacts by comparing checksums against official sources and examining git commit signatures for the relevant release window. Monitor the Wazuh repository for any unexpected commits, tag modifications, or releases that may have occurred during the token exposure period. Until workflow changes are confirmed, exercise heightened scrutiny when downloading artifacts from automated builds and prefer tagged releases with verified signatures.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today