CVE-2026-3854: GitHub Enterprise Server RCE Vulnerability

CVE-2026-3854 Overview

An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote code execution on the instance. During a git push operation, user-supplied push option values were not properly sanitized before being included in internal service headers. Because the internal header format used a delimiter character that could also appear in user input, an attacker could inject additional metadata fields through crafted push option values.

This vulnerability was reported via the GitHub Bug Bounty program and represents a significant security risk to organizations running self-hosted GitHub Enterprise Server installations. The command injection flaw (CWE-77) enables authenticated attackers with repository push permissions to execute arbitrary commands on the underlying server infrastructure.

Critical Impact

Authenticated attackers with push access to any repository can achieve full remote code execution on the GitHub Enterprise Server instance, potentially compromising source code, secrets, and enterprise infrastructure.

Affected Products

• GitHub Enterprise Server versions prior to 3.14.24
• GitHub Enterprise Server versions 3.15.x prior to 3.15.19
• GitHub Enterprise Server versions 3.16.x prior to 3.16.15
• GitHub Enterprise Server versions 3.17.x prior to 3.17.12
• GitHub Enterprise Server versions 3.18.x prior to 3.18.6
• GitHub Enterprise Server versions 3.19.x prior to 3.19.3

Discovery Timeline

• 2026-03-10 - CVE-2026-3854 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-3854

Vulnerability Analysis

The vulnerability exists in how GitHub Enterprise Server processes git push options during repository push operations. Git push options allow users to pass additional metadata to the receiving server using the --push-option flag. In vulnerable versions of GitHub Enterprise Server, these user-supplied values are incorporated into internal service headers without adequate sanitization.

The root issue stems from the internal header format using a delimiter character that can also appear in user-controlled input. This design flaw creates a classic injection scenario where an attacker can craft push option values containing the delimiter, effectively breaking out of the intended data field and injecting arbitrary metadata fields into the internal request.

When these manipulated internal headers are processed by backend services, the injected metadata can alter the execution context or trigger unintended code paths, ultimately leading to command execution on the server.

Root Cause

The vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command). The fundamental issue is insufficient input validation and sanitization of git push option values before they are incorporated into internal service communications. The internal header protocol failed to account for the possibility that user input might contain the same delimiter characters used to separate header fields, creating an injection vector.

Attack Vector

The attack is network-based and requires the attacker to have authenticated access with push permissions to at least one repository on the GitHub Enterprise Server instance. The exploitation path involves:

1. An attacker with push access initiates a git push operation to a repository
2. The attacker includes maliciously crafted --push-option values containing delimiter characters and injected metadata
3. GitHub Enterprise Server incorporates these unsanitized values into internal service headers
4. The delimiter injection allows the attacker to insert additional metadata fields
5. Backend services process the manipulated headers, leading to command execution

The attack does not require user interaction beyond the attacker's own authenticated actions, and successful exploitation grants the attacker command execution capabilities on the GitHub Enterprise Server host with the privileges of the application service.

Detection Methods for CVE-2026-3854

Indicators of Compromise

• Unusual or malformed git push option values in git server logs containing special characters or delimiter sequences
• Unexpected process spawning or command execution originating from GitHub Enterprise Server application processes
• Anomalous network connections initiated by the GitHub Enterprise Server instance
• Evidence of repository push operations followed by suspicious system-level activity

Detection Strategies

• Monitor git server logs for push operations containing suspicious push option patterns, particularly those with unexpected special characters
• Implement process monitoring on GitHub Enterprise Server instances to detect unexpected child processes spawned by the application
• Review authentication logs for accounts with push access that may have been compromised or are exhibiting unusual behavior
• Deploy network monitoring to identify unexpected outbound connections from the GitHub Enterprise Server infrastructure

Monitoring Recommendations

• Enable comprehensive audit logging for all git push operations including push option values
• Configure alerting for any command execution originating from GitHub Enterprise Server application contexts
• Implement file integrity monitoring on critical system directories and application binaries
• Establish baseline behavior for GitHub Enterprise Server processes to identify anomalous activity

How to Mitigate CVE-2026-3854

Immediate Actions Required

• Upgrade GitHub Enterprise Server to a patched version immediately: 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, or 3.19.3 depending on your release track
• Review git server logs for any suspicious push operations that may indicate prior exploitation attempts
• Audit accounts with repository push access and verify their legitimacy
• Consider temporarily restricting push access to trusted users until patching is complete

Patch Information

GitHub has released security patches addressing this vulnerability across all supported release branches. Organizations should upgrade to the appropriate fixed version based on their current release track:

• Version 3.14.x users: Upgrade to version 3.14.24
• Version 3.15.x users: Upgrade to version 3.15.19
• Version 3.16.x users: Upgrade to version 3.16.15
• Version 3.17.x users: Upgrade to version 3.17.12
• Version 3.18.x users: Upgrade to version 3.18.6
• Version 3.19.x users: Upgrade to version 3.19.3

Workarounds

• Restrict repository push access to only trusted users until patches can be applied
• Implement network segmentation to limit the blast radius of potential exploitation
• Deploy additional monitoring and alerting for suspicious git operations and system-level activity
• Consider placing GitHub Enterprise Server behind a web application firewall with rules to inspect git protocol traffic

# Check current GitHub Enterprise Server version
ghe-version

# Upgrade to patched version (example for 3.19.x track)
# Follow GitHub's official upgrade documentation for your environment
ghe-upgrade -y GitHub-Enterprise-3.19.3.pkg