CVE-2026-67308: Critical GitHub Actions Shell Injection — Detection and Remediation Guide

---
title: GitHub Actions Suspicious Command Execution from VERSION. Processing
id: 8d9e4a1f-7b5c-4d3e-9f2a-1c8b3d4e5f6a
status: experimental
description: Detects suspicious command execution potentially related to CVE-2026-67308 exploitation in GitHub Actions workflows processing VERSION.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-67308
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains: 'actions-runner'
    CommandLine|contains: 
      - 'VERSION.'
      - 'eval $'
      - 'bash -c'
  condition: selection
falsepositives:
  - Legitimate GitHub Actions workflows that process VERSION. files
level: high
---
title: GitHub Actions Credential Access via Environment Variables
id: 7c8f3b2e-6a4d-5c9e-0f1b-2d9e4f5a6b7c
status: experimental
description: Detects potential credential access related to CVE-2026-67308 where environment variables might be accessed in GitHub Actions
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-67308
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains: 'actions-runner'
    CommandLine|contains:
      - 'GITHUB_TOKEN'
      - 'AWS_ACCESS_KEY_ID'
      - 'AWS_SECRET_ACCESS_KEY'
      - 'printenv'
  condition: selection
falsepositives:
  - Legitimate credential usage in GitHub Actions workflows
level: medium
---
title: GitHub Actions Suspicious Network Activity from Runner
id: 6b7d2c1f-5a3c-4b8d-9e0a-1c8b2d3e4f5a
status: experimental
description: Detects suspicious outbound network connections from GitHub Actions runners potentially exfiltrating credentials
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-67308
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|contains: 'actions-runner'
    DestinationPort|notin:
      - 443
      - 22
  condition: selection
falsepositives:
  - Legitimate outbound connections from GitHub Actions runners
level: medium

// Detect potential CVE-2026-67308 exploitation via suspicious GitHub Actions activity
let SuspiciousCommands = dynamic(['eval $', 'bash -c', '&&', '|', '`']);
let CredentialKeywords = dynamic(['GITHUB_TOKEN', 'AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY']);
DeviceProcessEvents
| where InitiatingProcessFolderPath contains \"actions-runner\" 
| where ProcessCommandLine has_any(SuspiciousCommands) or ProcessCommandLine has_any(CredentialKeywords)
| where ProcessCommandLine has \"VERSION.\"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessFileName, ProcessCommandLine
| order by Timestamp desc
| extend AlertDetails = strcat(\"Potential CVE-2026-67308 exploitation detected on Device: \", DeviceName)


// Detect unusual network connections from GitHub Actions runners
DeviceNetworkEvents
| where InitiatingProcessFolderPath contains \"actions-runner\"
| where RemotePort notin (443, 22, 80, 8080)
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteURL
| order by Timestamp desc
| extend AlertDetails = strcat(\"Suspicious network connection from GitHub Actions runner on Device: \", DeviceName)


// Detect access to sensitive files in GitHub Actions workflows
Syslog
| where ProcessName contains \"actions-runner\" 
| where SyslogMessage has \"VERSION.\" and (SyslogMessage has \"cat\" or SyslogMessage has \"eval\" or SyslogMessage has \"curl\" or SyslogMessage has \"wget\")
| project TimeGenerated, ComputerName, ProcessName, SyslogMessage
| order by TimeGenerated desc
| extend AlertDetails = strcat(\"Potential access to VERSION. in GitHub Actions workflow on: \", ComputerName)

-- Hunt for GitHub Actions runners executing suspicious commands related to CVE-2026-67308
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()\WHERE Name =~ \"runner\" OR Exe =~ \"actions-runner\"
  AND (CommandLine =~ \"VERSION.\" 
       OR CommandLine =~ \"eval\\s\\$\" 
       OR CommandLine =~ \"bash\\s-c\"
       OR CommandLine =~ \"GITHUB_TOKEN\"
       OR CommandLine =~ \"AWS_ACCESS_KEY_ID\")


-- Search for VERSION. files recently accessed by GitHub Actions processes
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs=\"/**/VERSION.\")
WHERE Atime > now() - 7d
  AND Mode =~ \"^-rw.*\"
ORDER BY Atime DESC


-- Check for unusual network connections established by GitHub Actions runner processes
SELECT Pid, RemoteAddress, RemotePort, State, Family, Uid, StartTime
FROM netstat()
WHERE Pid IN (SELECT Pid FROM pslist() WHERE (Name =~ \"runner\" OR Exe =~ \"actions-runner\"))
  AND RemotePort NOT IN (22, 443, 80, 8080)
ORDER BY StartTime DESC

#!/bin/bash
# Script to detect and remediate CVE-2026-67308 in Wazuh workflows

# Colors for output
RED='\\033[0;31m'
GREEN='\\033[0;32m'
YELLOW='\\033[1;33m'
NC='\\033[0m' # No Color

echo \"Checking for CVE-2026-67308 vulnerable Wazuh workflows...\"

# Find all workflow files
echo \"Searching for workflow files...\"
WORKFLOW_DIRS=$(find / -name \".github\" -type d 2>/dev/null | head -20)

if [ -z \"$WORKFLOW_DIRS\" ]; then
  echo -e \"${YELLOW}No .github directories found. If GitHub Actions is used, ensure the script runs in the correct repository context.${NC}\"
  exit 1
fi

# Check for vulnerable Wazuh workflows
VULNERABLE_FOUND=false

for dir in $WORKFLOW_DIRS; do
  WORKFLOW_PATH=\"$dir/workflows\"
  if [ -d \"$WORKFLOW_PATH\" ]; then
    echo \"Checking workflows in: $WORKFLOW_PATH\"
    
    # Look for Wazuh workflows
    WAZUH_WORKFLOWS=$(grep -r -l \"wazuh\" \"$WORKFLOW_PATH\" 2>/dev/null)
    
    for workflow in $WAZUH_WORKFLOWS; do
      echo \"Analyzing Wazuh workflow: $workflow\"
      
      # Check for VERSION. references
      if grep -q \"VERSION.\" \"$workflow\" 2>/dev/null; then
        # Check for commit hash reference
        if ! grep -q \"44bf114\" \"$workflow\" 2>/dev/null; then
          echo -e \"${RED}VULNERABLE: $workflow references VERSION. but does not include the patched commit 44bf114${NC}\"
          VULNERABLE_FOUND=true
          
          # Check for environment variable interpolation
          if grep -E \"\\$\\{.*\\}\" \"$workflow\" 2>/dev/null | grep -q \"VERSION\"; then
            echo -e \"${RED}POTENTIAL EXPLOITATION PATH: Environment variable interpolation with VERSION detected${NC}\"
          fi
        else
          echo -e \"${GREEN}SECURE: $workflow includes the patched commit 44bf114${NC}\"
        fi
      fi
    done
  fi
done

if [ \"$VULNERABLE_FOUND\" = true ]; then
  echo -e \"${RED}ACTION REQUIRED: Vulnerable workflows detected. Please update to Wazuh workflow version 44bf114 or later.${NC}\"
  echo \"To remediate:\"
  echo \"1. Update Wazuh workflows to commit 44bf114 or later\"
  echo \"2. Review and restrict permissions on GitHub Actions runners\"
  echo \"3. Audit GitHub Actions tokens and credentials for potential compromise\"
  exit 1
else
  echo -e \"${GREEN}No vulnerable workflows detected. Current workflows appear to be patched or do not use the vulnerable functionality.${NC}\"
  exit 0
fi