CVE-2025-15617

HighCVSS 8.1/10Last modified Oct 7, 2026

Description

Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOKEN from uploaded artifacts. Attackers can use the exposed token within a limited time window to perform unauthorized actions such as pushing malicious commits or altering release tags.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
Wazuh	Wazuh (GitHub Actions)	4.12.0

References

https://github.com/wazuh/wazuh/security/advisories/GHSA-6xqr-4q5g-xc7xExploit, Vendor Advisory
https://www.vulncheck.com/advisories/exposure-of-the-github-token-in-wazuh-workflow-run-artifactThird Party Advisory
https://github.com/wazuh/wazuh/security/advisories/GHSA-6xqr-4q5g-xc7xExploit, Vendor Advisory

Timeline

Published: Mar 27, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-156189.1Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key. Business::OnlinePayment::StoredTrans CVE-2025-156193.5HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenari CVE-2025-15629.8The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable CVE-2025-156208.6HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web inter CVE-2025-156216.0Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 cre CVE-2025-156226.2Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals plaintext OAuth2 cli CVE-2025-156237.5Exposure of Private Personal Information to an Unauthorized Actor, : Exposure of Sensitive System Information to an Unauthorized Control Sph CVE-2025-156247.5Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. In a setup where OpenID is used as the prim CVE-2025-156259.8Unauthenticated user is able to execute arbitrary SQL commands in Sparx Pro Cloud Server database in certain cases.CVE-2025-156265.3Authenticated user can bypass authorization in Ribblr - Crochet & Knitting iOS application CVE-2025-156277.5A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptographic keys to establish trust and CVE-2025-156287.5Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed d