Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.7
CVE-2026-104608: GitHub Enterprise Server Git service can run attacker commands
CVE-2026-104608 · published 1 day ago
Summary
The Git service in GitHub Enterprise Server could let an attacker who has an account and SSH access run their own commands on the server, potentially exposing secret data. This problem exists in all versions released before 3.23. Update to version 3.22.3, 3.21.8, 3.20.10, or 3.19.14 (or later) to fix it.
What to do
- Update github enterprise server to version 3.19.14.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| github | enterprise server |
< 3.19.* Fix: upgrade to 3.19.14
|
Original advisory text
Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service
A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment secrets. Exploitation required per-build memory offsets; failed attempts crashed babeld. This affected all releases prior to 3.23 and was fixed in 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.
References
Severity
7.7
High
Type
CWE-416Use After Free
CWE-1265Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls
Timeline
Published3 Nov 2026
Updated4 Nov 2026
First seen3 Nov 2026
Track software like this
Free during beta