Critical Command Injection Vulnerability in GitHub (CVE-2026-3854) Exposed Millions of Repositories to RCE
Critical GitHub RCE Flaw (CVE-2026-3854) Allowed Full Server Compromise via Single 'git push'
Related Entities
CVE Identifiers
Full Report
Executive Summary
Security firm Wiz has discovered and disclosed a critical remote code execution (RCE) vulnerability in GitHub, tracked as CVE-2026-3854 with a CVSS score of 8.7. The flaw was a command injection bug exploitable by any authenticated user via a single git push command. It impacted the multi-tenant GitHub.com service as well as self-hosted GitHub Enterprise Server (GHES) instances. Successful exploitation on GitHub.com could have granted access to millions of public and private repositories, while on GHES it could lead to a full compromise of the server. GitHub quickly patched the issue on its cloud service and released updates for GHES. However, at the time of disclosure, an estimated 88% of internet-facing GHES instances were still unpatched, posing a significant supply chain risk.
Vulnerability Details
The vulnerability was a command injection flaw in the backend service that processes git push operations. When a user performs a git push, they can include options using the --push-option flag. The researchers at Wiz found that GitHub's backend did not properly sanitize these user-supplied option strings before passing them to downstream services.
The internal protocol used a delimiter character that could also be injected by an attacker within the push option's value. This allowed an attacker to break out of the intended data field and inject malicious metadata fields into the internal service headers. A downstream service would then misinterpret this injected metadata as a legitimate command and execute it on the backend server, leading to RCE.
The exploit was described as easy to perform, requiring only a standard git client, authentication to GitHub, and push access to at least one repository.
Affected Systems
- GitHub.com: The multi-tenant cloud service was vulnerable. The issue has been mitigated by GitHub.
- GitHub Enterprise Cloud: The cloud-hosted enterprise service was vulnerable and has been patched.
- GitHub Enterprise Server (GHES): The following self-hosted versions are vulnerable:
- Versions before 3.14.25
- Versions before 3.15.20
- Versions before 3.16.16
- Versions before 3.17.13
- Versions before 3.18.8
- Versions before 3.19.4
Exploitation Status
There is no evidence that this vulnerability was exploited in the wild before it was reported by Wiz. GitHub acted quickly to patch its own infrastructure. However, the public disclosure and the high number of unpatched self-hosted GHES instances create a significant window of opportunity for attackers.
Impact Assessment
The impact of CVE-2026-3854 is severe and represents a major software supply chain risk:
- On GitHub.com: Exploitation granted RCE on shared storage nodes. While likely sandboxed, this could have potentially provided access to source code from millions of public and private repositories, including sensitive secrets, intellectual property, and personal data.
- On GitHub Enterprise Server: The impact is even more critical. A successful exploit could lead to a full compromise of the self-hosted server. This would give an attacker complete control over all source code repositories, CI/CD pipelines, and internal secrets (e.g., API keys, credentials) stored on the instance. An attacker could inject malicious code into production applications, creating a widespread supply chain attack.
At the time of disclosure, Wiz estimated that 88% of internet-facing GHES instances were still vulnerable, making this a high-priority issue for many organizations.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised systems:
git push --push-option--push-option.github-logs/git-actions.log (on GHES)Detection Methods
- Version Scanning: Use asset management or vulnerability scanning tools to identify all instances of GitHub Enterprise Server in your environment and check if their version numbers are below the patched levels.
- Log Analysis (D3-NTA): Centralize and analyze logs from GHES instances. Create detection rules to look for
git pushcommands with abnormally long or complex--push-optionstrings, especially those containing shell metacharacters. - Behavioral Monitoring: Monitor GHES servers for anomalous behavior, such as unexpected processes being spawned by git-related services or outbound network connections to unknown destinations.
Remediation Steps
- Upgrade GitHub Enterprise Server Immediately (D3-SU): Organizations running self-hosted GHES must upgrade to a patched version (e.g., 3.14.25+, 3.15.20+, etc.) as a top priority. This is the only way to fix the vulnerability.
- Restrict Access: If an immediate upgrade is not possible, restrict access to the GHES instance at the network level to only trusted IPs. Also, review user permissions and limit push access on critical repositories to the smallest possible group of trusted developers.
- Audit and Rotate Secrets: After upgrading, conduct a thorough audit of all repositories for any signs of tampering. It is also highly recommended to rotate all secrets, API keys, and credentials stored within the GHES instance or in repositories, as a precautionary measure against potential prior compromise.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
Administrators of GitHub Enterprise Server must upgrade their instances to a patched version to eliminate the vulnerability.
Exploit Protection
Implementing input validation and sanitization on application inputs is a fundamental security practice that would have prevented this command injection flaw.
As a temporary measure, restricting network access to the GitHub Enterprise Server to only trusted IP ranges can reduce exposure.
D3FEND Defensive Countermeasures
The only effective remediation for CVE-2026-3854 is to upgrade all self-hosted GitHub Enterprise Server (GHES) instances to a patched version (3.14.25+, 3.15.20+, etc.). Given the criticality of the flaw and the simplicity of exploitation, this should be considered an emergency update. Organizations should immediately inventory all GHES instances, including development and testing environments, and apply the patch. For organizations where patching is delayed, taking the instance offline or severely restricting its network access should be considered as a temporary, high-impact mitigation.
While the vulnerability lies within GitHub's code, this incident highlights the need for defense-in-depth. Organizations should review their GHES configurations to enforce the principle of least privilege. This includes auditing user permissions to ensure that only a minimum number of developers have push access to critical repositories. Implement branch protection rules that require pull request reviews before code can be merged into main branches. This doesn't prevent the exploit but can limit an attacker's ability to inject malicious code into a production release even if they compromise a developer account with push access.
Timeline of Events
Wiz reports the RCE vulnerability to GitHub's security team.
Wiz and GitHub publicly disclose CVE-2026-3854 after patches have been made available.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.