CVE-2025-15617 - CVE House

Back to Database

Status published High CVE-2025-15617

Wazuh GitHub Actions Workflow Exposure of Sensitive Credentials

8.3 CVSS

Vulnerability Description

Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOKEN from uploaded artifacts. Attackers can use the exposed token within a limited time window to perform unauthorized actions such as pushing malicious commits or altering release tags.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-15617

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

jackhac
nopcorn
nopcorn
vikman90

References

More from Wazuh

View All →

Wazuh Agent and Manager OS Command Injection and Untrusted Search Path

Wazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of Service

Wazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCE

Remote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theft

Wazuh authd service (os_auth) Heap-based Buffer Overflow

Affected Vendor

Wazuh

View all reports →

Affected Software

Wazuh (GitHub Actions)

Vulnerable Versions:

4.12.0

Timeline

Official Publish: March 27th, 2026

Last Modified: May 12th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1552 Unsecured Credentials

Credential Access

T1555 Credentials from Password Stores

Credential Access

T1078 Valid Accounts

T1021 Remote Services

Lateral Movement

T1098 Account Manipulation

Privilege Escalation