GitHub Pays $100,000 Bounty for Critical RCE Flaw in Git Push Pipeline
GitHub paid Saif Ghani $100,000 for CVE-2026-3854, a critical unauthenticated RCE in its Git push pipeline allowing command execution on backend infrastructure.
GitHub awarded researcher Saif Ghani $100,000, its largest publicly disclosed bug bounty, for CVE-2026-3854, a critical unauthenticated remote code execution flaw in its Git push processing pipeline. A crafted repository URL could trigger arbitrary command execution on backend infrastructure, threatening source code integrity, repository secrets, and software supply chains. GitHub deployed mitigations and completed a patch rollout through coordinated disclosure before technical details became public.
- Critical unauthenticated RCE CVE-2026-3854 in GitHub's Git push pipeline earned a $100,000 bounty.
- Crafted repository URLs could yield shell-level access to GitHub backend infrastructure.
- Patched via coordinated disclosure; no exploitation reported before rollout.
- GitHub's Vulnerability Reward Program tops out at $150,000 for critical flaws.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-3854 | Header-injection RCE via git push options in GitHub Enterprise Server CVE-2026-3854 is an improper neutralization flaw (CWE-77) in GitHub Enterprise Server in which user-supplied git push option values are placed into internal service headers without sanitization. An authenticated user with push access to any repository can trigger it with a single crafted git push, injecting additional metadata fields through the delimiter character used in the internal header format. Successful injection yields remote code execution on the GHES instance, giving the attacker control of the server and the code repositories it hosts. All self-hosted GHES deployments running affected builds in the 3.14 through 3.19 branches are affected; fixes are available in 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7 and 3.19.4. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the 40% EPSS score (99th percentile) indicates a high probability of exploitation within 30 days, and the flaw is not yet in CISA's KEV catalog. Do: Upgrade GitHub Enterprise Server to 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7 or 3.19.4 (or later in each branch) as a priority, given the 40% EPSS likelihood of near-term exploitation. If patching must wait, review and restrict push-access grants to trusted users and consider disabling git push options (receive.advertisePushOptions=false) since they are the injection vector. Check GHES upgrade and push-related logs for anomalous activity from accounts with push access. | 8.7 | 40% |
| large≈ tens of thousands of self-hosted GHES deployments (enterprise installs, many internet-exposed; researchers cited in coverage report ~88% of self-hosted… |
Full article539 words · extracted from cybersecuritynews.com · click to collapse
GitHub has awarded security researcher Saif Ghani a $100,000 bug bounty after the disclosure of CVE-2026-3854, a critical remote code execution vulnerability affecting GitHub’s Git push processing pipeline.
The reward is reportedly the largest publicly disclosed payment made through GitHub’s Vulnerability Reward Program. Ghani, known on X as @sagitz_, announced the bounty on July 22, 2026.
GitHub Security later publicly acknowledged the researcher, confirming it addressed the issue through coordinated disclosure and remediation.
The vulnerability reportedly enabled an unauthenticated attacker to execute arbitrary commands on GitHub backend infrastructure by submitting a specially crafted repository URL during Git-related operations.
The flaw stemmed from how a vulnerable service processed repository data and URLs in the Git push workflow. Remote code execution vulnerabilities are among the most serious flaws affecting software platforms because they can allow attackers to run commands within a targeted environment.
GitHub Pays Bounty for Git Push RCE Flaw
In this case, successful exploitation could have provided access to an affected server context, creating risks for repository integrity, source code confidentiality, credentials, and software supply-chain security.
According to the disclosed technical details, the attack path involved malicious repository input that reached backend processing components without proper sanitization or safe handling.
An attacker could allegedly use crafted values to manipulate command execution behavior and obtain shell-level access to the vulnerable environment.
Once code execution is achieved on a source code hosting platform, the impact can extend beyond a single repository. A threat actor could potentially access repository secrets, modify build-related files, alter source code, or interfere with Git objects handled by the service.
Such access could support downstream supply-chain attacks by inserting malicious code into projects trusted by developers and enterprises.
GitHub reportedly deployed mitigations shortly after receiving the report and completed a patch rollout across affected services.
The coordinated disclosure process allowed the company to fix the issue before detailed exploitation information became widely available.
CVE-2026-3854 highlights the security importance of Git infrastructure, especially repository URL parsing, Git protocol handling, server-side hooks, archive generation, and backend automation.
These components often process attacker-controlled data and may interact with operating system commands, internal APIs, storage systems, and credentialed services.
According to RuntimeWire, GitHub’s $100,000 payout highlights the potential impact of a platform-level vulnerability affecting both public and private repositories.
The company’s Vulnerability Reward Program offers high rewards for critical flaws that could compromise core GitHub services, with top-tier payments reaching up to $150,000.
The incident also demonstrates why bug bounty programs remain important for major developer platforms. External researchers can identify complex attack paths that automated testing and internal reviews may miss, particularly where Git operations, cloud infrastructure, and supply-chain workflows intersect.
For organizations using GitHub, the case reinforces the need to protect repository secrets, enforce signed commits, review CI/CD workflow changes, apply branch protections, and monitor unusual Git activity.
A compromise at a major code-hosting provider can create a wide downstream security impact, making rapid vulnerability reporting and remediation essential for the wider software ecosystem.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
Abinayahttps://cybersecuritynews.com/
Abi is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/github-pays-bounty-for-rce-flaw-in-git-push/