Which versions of Wazuh are affected by CVE-2025-15617?

Wazuh version 4.12.0 contains a credential exposure vulnerability in GitHub Actions workflows that allows unauthenticated attackers to extract GITHUB_TOKEN secrets and potentially compromise the…

How to fix or mitigate CVE-2025-15617?

Within 24 hours: Audit your Wazuh deployment version and verify whether 4.12.0 is in use; if so, restrict repository push permissions and enable multi-factor authentication on critical GitHub accounts. Within 7 days: Contact Wazuh support for guidance on interim mitigations and patch timelines; implement network segmentation to limit exposure of GitHub Actions workflows if feasible. Within 30 days: Deploy patched version immediately upon release by the vendor; conduct integrity verification of any commits or releases made to your Wazuh fork or integrated repository during the exposure window.

Wazuh CVE-2025-15617

Q: What is the CVSS score of CVE-2025-15617?

CVE-2025-15617 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-209105 HIGH

Insufficiently Protected Credentials (CWE-522)

2026-03-27 disclosure@vulncheck.com

GHSA-r33m-965m-8chx

Authentication Bypass Wazuh

8.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 27, 2026 - 18:22 euvd

EUVD-2025-209105

Analysis Generated

Mar 27, 2026 - 18:22 vuln.today

CVE Published

Mar 27, 2026 - 18:16 nvd

HIGH 8.3

DescriptionCVE.org

Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOKEN from uploaded artifacts. Attackers can use the exposed token within a limited time window to perform unauthorized actions such as pushing malicious commits or altering release tags.

AnalysisAI

GitHub Actions workflow artifacts in Wazuh version 4.12.0 expose GITHUB_TOKEN credentials that unauthenticated network attackers can extract and use within a limited time window to push malicious commits or alter release tags in the project repository. The vulnerability carries a CVSS 4.0 score of 8.3 with high integrity impact and low availability impact. No public exploit identified at time of analysis, though the vulnerability is classified under authentication bypass tags by VulnCheck.

Technical ContextAI

This vulnerability stems from CWE-522 (Insufficiently Protected Credentials), where GitHub Actions workflow execution results in GITHUB_TOKEN secrets being inadvertently included in uploaded artifacts. The affected product is cpe:2.3:a:wazuh:wazuh:4.12.0 based on version specificity. GitHub Actions automatically provisions short-lived GITHUB_TOKEN credentials with repository-scoped permissions for workflow runs. When these tokens are captured in artifacts (logs, build outputs, or other uploaded files), they become accessible to anyone who can download the artifact before token expiration. The token's permissions typically include repository write access, enabling modification of code, tags, and releases. This exposure transforms a CI/CD security boundary into an attack vector for supply chain compromise.

RemediationAI

Review the vendor security advisory at https://github.com/wazuh/wazuh/security/advisories/GHSA-6xqr-4q5g-xc7x for specific remediation guidance. The fix likely involves modifying GitHub Actions workflow configurations to prevent GITHUB_TOKEN inclusion in artifacts through environment variable sanitization, artifact filtering, or workflow permission restrictions. Organizations consuming Wazuh releases should verify the integrity of version 4.12.0 artifacts by comparing checksums against official sources and examining git commit signatures for the relevant release window. Monitor the Wazuh repository for any unexpected commits, tag modifications, or releases that may have occurred during the token exposure period. Until workflow changes are confirmed, exercise heightened scrutiny when downloading artifacts from automated builds and prefer tagged releases with verified signatures.