CVE-2026-67308 describes a shell injection vulnerability in Wazuh's GitHub Actions workflows affecting versions before commit 44bf114. Attackers can exploit this by submitting pull requests containing crafted VERSION.json files with shell metacharacters injected into environment variables. These variables are directly interpolated into workflow run steps without proper sanitization, enabling arbitrary command execution. The attack vector is particularly dangerous on self-hosted runners where sensitive secrets such as GITHUB_TOKEN and AWS credentials can be exfiltrated. The vulnerability is triggered via fork pull requests, a common supply chain attack vector. Successful exploitation could lead to full compromise of CI/CD pipelines and exposure of cloud credentials. This represents a significant risk to organizations using Wazuh's open-source security platform with self-hosted GitHub Actions runners.