CVE-2025-15617: 
Wazuh Server vulnerability analysis and mitigation

CVE-2025-15617 is a credential exposure vulnerability in Wazuh 4.12.0's GitHub Actions CI/CD pipeline that allows unauthenticated attackers to extract the GITHUB_TOKEN from uploaded workflow artifacts. The flaw exists in the 4_testintegration_fim-tier-0-1-win.yml workflow, which uploads a zip of the current working directory — including the .git/config file containing the auto-generated GITHUB_TOKEN — as a build artifact. Disclosed on March 27, 2026, it affects only Wazuh version 4.12.0 (GitHub Actions component). It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 8.3 (High) (Wazuh Advisory, Feedly).

The root cause is classified as CWE-522 (Insufficiently Protected Credentials): the actions/upload-artifact@v4 action in the affected workflow uploads the entire current directory as a zip artifact, inadvertently including .git/config, which GitHub automatically populates with the ephemeral GITHUB_TOKEN for the workflow run. An unauthenticated attacker monitoring public GitHub Actions runs can download this artifact during the brief window between artifact upload and workflow completion, extract the token from .git/config, and use it against the GitHub API before it expires. The attack requires high complexity due to the narrow time window, but no privileges or user interaction are needed (Wazuh Advisory).

Successful exploitation allows an attacker to use the extracted GITHUB_TOKEN to push malicious commits to the Wazuh repository's master branch or rewrite release tags to point to backdoored code, creating a significant supply chain risk for all downstream users of the Wazuh project. The integrity impact is high, as an attacker could inject backdoors into official releases; availability is marginally affected. Confidentiality impact is low since the token itself does not expose source code directly, but the ability to alter release artifacts poses a severe risk to the integrity of the software supply chain (Wazuh Advisory, Feedly).

1. Reconnaissance: Monitor the public Wazuh GitHub repository (github.com/wazuh/wazuh) for new runs of the ci.yml or 4_testintegration_fim-tier-0-1-win.yml workflow using the GitHub API or GitHub Actions UI.
2. Wait for artifact availability: Poll the GitHub Actions API endpoint (GET /repos/wazuh/wazuh/actions/runs/{run_id}/artifacts) until the build artifact is listed as available for download.
3. Download the artifact: Use the GitHub API or direct download link to retrieve the uploaded zip artifact before the workflow run completes and the token expires.
4. Extract the GITHUB_TOKEN: Unzip the artifact and read .git/config to locate the GITHUB_TOKEN embedded in the [credential] or remote URL section.
5. Abuse the token: Authenticate to the GitHub API using the extracted token (e.g., Authorization: token <GITHUB_TOKEN>) and push a malicious commit to the master branch, or update release tags to reference a backdoored commit, affecting all downstream users who download Wazuh releases (Wazuh Advisory).

• Network: Unusual or automated API requests to https://api.github.com/repos/wazuh/wazuh/actions/runs/*/artifacts from unknown IP addresses; repeated artifact download requests during active workflow runs.
• Logs: GitHub audit logs showing artifact downloads by unauthenticated or unexpected users during workflow execution windows; API calls using a GITHUB_TOKEN from an IP not associated with the CI runner.
• Repository Activity: Unexpected commits to the master branch or modifications to release tags not initiated by known maintainers; commit authors or API tokens not matching established contributor patterns.
• File System (CI Runner): Presence of .git/config containing GITHUB_TOKEN within uploaded artifact zip files in the Actions artifact storage (Wazuh Advisory).

The primary fix is to update the affected workflow to only include specific required files in the artifact upload, explicitly excluding .git/config and any environment variable files. Wazuh's advisory recommends: upgrading to a version of Wazuh newer than 4.12.0 once a patched release is available; restricting GITHUB_TOKEN permissions in workflow configurations to the minimum required (e.g., permissions: read-all); implementing artifact retention policies to minimize the exposure window; and monitoring repository activity for unauthorized commits or tag modifications. Rotating any potentially exposed tokens and auditing recent workflow artifact downloads is also advised (Wazuh Advisory, Feedly).

The vulnerability was reported by security researchers jackhac and nopcorn and coordinated by vikman90 from the Wazuh team, with the advisory published on June 16, 2025. The issue was also independently tracked by VulnCheck and registered in the ENISA European Vulnerability Database (EUVD-2025-209105). Community discussion was noted on Bluesky and CVE tracking platforms, though broader media coverage has been limited given the moderate severity and narrow exploitation window (Wazuh Advisory, VulnCheck Advisory).