EUVD-2025-209105
GHSA-r33m-965m-8chx
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V6 - Authentication Credential protection in transit/storage
|
| Impact | The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L) indicates network-accessible exploitation with high attack complexity but no authentication required, resulting in high integrity impact. The high attack complexity (AC:H) reflects the time-sensitive nature of exploitation-attackers must identify and extract the token before it expires and while artifacts remain accessible. Real-world risk is elevated by the authentication bypass classification and the potential for supply chain attacks against an open-source security platform. The vulnerability specifically targets the Wazuh project's own infrastructure rather than end-user deployments, limiting the blast radius to the software distribution mechanism. Without EPSS data or KEV confirmation, exploitation likelihood depends on attacker awareness of the specific workflow configuration. The technical impact (unauthorized code commits and tag manipulation) presents significant software integrity risks for users trusting official releases. |
| Exploit ScenarioDerived | An attacker monitors public GitHub repositories for workflow artifact uploads and specifically targets the Wazuh 4.12.0 build artifacts. By downloading the affected artifact before the embedded GITHUB_TOKEN expires (typically within hours), the attacker extracts the credentials and authenticates to GitHub's API with repository write permissions. Using the stolen token, the attacker pushes a commit containing backdoored installation scripts to a release branch or modifies an existing release tag to point to malicious code, compromising users who download and install what appears to be an official Wazuh release. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 27, 2026
GitHub Actions workflow artifacts in Wazuh version 4.12.0 expose GITHUB_TOKEN credentials that unauthenticated network attackers can extract and use within a limited time window to push malicious commits or alter release tags in the project repository. The vulnerability carries a CVSS 4.0 score of 8.3 with high integrity impact and low availability impact. No public exploit identified at time of analysis, though the vulnerability is classified under authentication bypass tags by VulnCheck.
RemediationAI
Review the vendor security advisory at https://github.com/wazuh/wazuh/security/advisories/GHSA-6xqr-4q5g-xc7x for specific remediation guidance. The fix likely involves modifying GitHub Actions workflow configurations to prevent GITHUB_TOKEN inclusion in artifacts through environment variable sanitization, artifact filtering, or workflow permission restrictions. Organizations consuming Wazuh releases should verify the integrity of version 4.12.0 artifacts by comparing checksums against official sources and examining git commit signatures for the relevant release window. Monitor the Wazuh repository for any unexpected commits, tag modifications, or releases that may have occurred during the token exposure period. Until workflow changes are confirmed, exercise heightened scrutiny when downloading artifacts from automated builds and prefer tagged releases with verified signatures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from CWE-522 (Insufficiently Protected Credentials), where GitHub Actions workflow execution results in GITHUB_TOKEN secrets being inadvertently included in uploaded artifacts. The affected product is cpe:2.3:a:wazuh:wazuh:4.12.0 based on version specificity. GitHub Actions automatically provisions short-lived GITHUB_TOKEN credentials with repository-scoped permissions for workflow runs. When these tokens are captured in artifacts (logs, build outputs, or other uploaded files), they become accessible to anyone who can download the artifact before token expiration. The token's permissions typically include repository write access, enabling modification of code, tags, and releases. This exposure transforms a CI/CD security boundary into an attack vector for supply chain compromise.
Know when Wazuh gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Primary rating from Vendor (vulncheck) · only source for this CVE.
CVSS VectorVendor: vulncheck
DescriptionCVE.org
Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOKEN from uploaded artifacts. Attackers can use the exposed token within a limited time window to perform unauthorized actions such as pushing malicious commits or altering release tags.
Executive ViewAI
Wazuh version 4.12.0 contains a credential exposure vulnerability in GitHub Actions workflows that allows unauthenticated attackers to extract GITHUB_TOKEN secrets and potentially compromise the project repository through malicious commits or release tag manipulation. Organizations relying on Wazuh for security operations face integrity risks to their monitoring infrastructure if the upstream project is compromised, with potential downstream impact to all dependent deployments.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable or isolate GitHub Actions workflows in affected repositories until patch availability; (2) Rotate all repository credentials and enforce short-lived token expiration policies; (3) Implement branch protection rules requiring code review and signed commits; (4) Monitor repository audit logs for unauthorized push or tag modification events; (5) Use GitHub-native secret management with minimal token scope (repo-limited, not full admin access) for CI/CD pipelines.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl comman
Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in version
Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that alr
Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running v
A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achi
Wazuh Agent before 4.13.0 on Windows can be made by an authenticated, high-privileged configuration writer to open attac
Remote code execution on the Wazuh cluster master node is achievable by any attacker who controls a cluster worker node,
Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or dele
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversa
Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-pr
Unauthenticated remote denial of service in the Wazuh cluster daemon (wazuh-clusterd) allows a network peer to exhaust p
Exploit-DB