CVE-2025-15617 is a high-severity vulnerability affecting Wazuh version 4.12.0 related to insufficient protection of credentials (CWE-522) in GitHub Actions workflow artifacts. Specifically, the GITHUB_TOKEN used in the workflow is exposed through uploaded artifacts, enabling attackers to extract it. With this token, attackers can perform unauthorized actions such as pushing malicious commits or altering release tags within a limited time window. The vulnerability has a CVSS 4.0 base score of 8.3, indicating a significant risk if exploited. No patch or official remediation guidance is currently provided, and the product is not a cloud service, so remediation depends on vendor updates or user action.

The exposed GITHUB_TOKEN can be used by attackers to perform unauthorized actions in the affected repository, including pushing malicious commits and modifying release tags. This can lead to code integrity compromise and potential supply chain risks. The vulnerability requires network access and has a high attack complexity, but no privileges or user interaction are needed. The impact is limited by the token's validity window but remains significant due to the ability to alter source code and releases.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using Wazuh version 4.12.0 in environments where GitHub Actions artifacts might be exposed. Consider restricting artifact access and rotating tokens frequently. Monitor official Wazuh channels for updates and apply patches promptly once released.