GitHub Pays $100,000 Bounty for Critical RCE Flaw in Git Push Pipeline
GitHub paid Saif Ghani $100,000 for CVE-2026-3854, a critical unauthenticated RCE in its Git push pipeline allowing command execution on backend infrastructure.
GitHub awarded researcher Saif Ghani $100,000, its largest publicly disclosed bug bounty, for CVE-2026-3854, a critical unauthenticated remote code execution flaw in its Git push processing pipeline. A crafted repository URL could trigger arbitrary command execution on backend infrastructure, threatening source code integrity, repository secrets, and software supply chains. GitHub deployed mitigations and completed a patch rollout through coordinated disclosure before technical details became public.
- Critical unauthenticated RCE CVE-2026-3854 in GitHub's Git push pipeline earned a $100,000 bounty.
- Crafted repository URLs could yield shell-level access to GitHub backend infrastructure.
- Patched via coordinated disclosure; no exploitation reported before rollout.
- GitHub's Vulnerability Reward Program tops out at $150,000 for critical flaws.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-3854 | Header-injection RCE via git push options in GitHub Enterprise Server | 8.7 | 40% |
From the original article
2 min read at cybersecuritynews.com
GitHub has awarded security researcher Saif Ghani a $100,000 bug bounty after the disclosure of CVE-2026-3854, a critical remote code execution vulnerability affecting GitHub’s Git push processing pipeline. The reward is reportedly the largest publicly disclosed payment made through GitHub’s Vulnerability Reward Program. Ghani, known on X as @sagitz_, announced the bounty on July 22, […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.