CVE-2025-15617 is a medium severity vulnerability affecting Wazuh version 4.12.0. It involves insufficient protection of credentials in GitHub Actions workflows, specifically the exposure of the GITHUB_TOKEN through workflow artifacts. Attackers who access these artifacts can extract the token and use it to perform unauthorized repository actions such as pushing commits or modifying release tags. The vulnerability is identified as CWE-522 and has a CVSS 4.0 score of 6.3, reflecting network attack vector with high attack complexity and high impact on integrity and availability. No patch or official fix information is provided in the available data.

The vulnerability allows attackers to extract the GITHUB_TOKEN from GitHub Actions workflow artifacts, enabling unauthorized actions within the affected repository. This can lead to malicious commits or unauthorized changes to release tags, potentially compromising the integrity of the codebase and release process. The impact is limited by the token's validity window and the scope of permissions granted to the token. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting permissions of the GITHUB_TOKEN, avoid uploading sensitive tokens in workflow artifacts, and review GitHub Actions workflows for exposure risks. Monitor official Wazuh and GitHub advisories for updates and apply patches promptly once released.