Critical GitHub Enterprise Server Vulnerability Enables Remote Code Execution and Full Server Compromise

Security researchers disclosed a critical vulnerability in GitHub Enterprise Server (GHES), tracked as CVE-2026-3854, that allows Remote Code Execution (RCE) and can potentially lead to full server compromise.

The issue affects GitHub’s internal Git infrastructure and could allow any authenticated user to compromise backend systems, access private repositories, and gain control over sensitive internal resources.

For GitHub Enterprise Server environments, the impact is especially severe because successful exploitation may result in complete server takeover.

How the Attack Works

The vulnerability is linked to how GitHub’s internal git proxy component, babeld, processes user-supplied push options when using:

git push -o

These values are written into an internal X-Stat header where the semicolon character (“;”) is used as a field delimiter.

Because input validation was insufficient, attackers could inject additional key-value parameters and overwrite security-critical fields such as:

• rails_env
• custom_hooks_dir
• repo_pre_receive_hooks

This made it possible to build a full exploit chain without privilege escalation or additional zero-day dependencies.

The Path to Full Remote Code Execution

The attack chain involved three main stages:

1. Sandbox Bypass

By changing rails_env to a non-production value, the pre-receive hook process switched from a sandboxed path to direct unsandboxed execution.

2. Hook Directory Redirection

Using custom_hooks_dir, the attacker could control where the system searched for hook scripts.

3. Path Traversal and Arbitrary Binary Execution

Through repo_pre_receive_hooks, attackers could trigger execution of an arbitrary binary directly from the filesystem as the git service user.

The result was full Remote Code Execution on the server.

What This Means for GitHub Enterprise Server

Successful exploitation could lead to:

• full access to all hosted repositories
• read/write access to source code
• access to internal secrets and credentials
• CI/CD environment compromise
• lateral movement across connected systems

GitHub confirmed that GitHub.com was also theoretically affected, but no evidence of active exploitation was found before the fix was deployed.

Affected Versions and Available Fixes

GitHub Enterprise Server

Vulnerable versions:
≤ 3.19.1

Fixed versions:

• 3.14.25
• 3.15.20
• 3.16.16
• 3.17.13
• 3.18.8
• 3.19.4+

According to Wiz, approximately 88% of GHES instances remained unpatched at the time of disclosure.

What DIAMATIX Recommends

Organizations using GitHub Enterprise Server should immediately:

• apply all available security patches
• review /var/log/github-audit.log for unusual git push operations
• investigate suspicious push option values containing special characters
• restrict access to administrative Git operations
• review repository access controls and service account permissions

With vulnerabilities like this, response speed is critical.

CISO Analysis

This case highlights how dangerous internal trust relationships between infrastructure components can become.

The issue was not a classic internet-facing frontend vulnerability, but an internal logic flaw between services that were considered trusted by design.

These are often the attack paths that remain invisible to traditional security controls.

Most importantly, exploitation required nothing more than a standard git client and a valid account. That makes the attack realistic not only for external threat actors, but also for insider threat scenarios.

In enterprise environments, Git platforms are no longer just developer tools. They are part of the organization’s critical operational infrastructure.

Sources

• Wiz Research – Technical analysis of CVE-2026-3854
• GitHub Security Advisory – GitHub Enterprise Server patches
• GitHub Enterprise Server Release Notes – Fixed versions and mitigation guidance