88% of self-hosted GitHub servers exposed to RCE, researchers warn (CVE-2026-3854)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-3854 | Header-injection RCE via git push options in GitHub Enterprise Server CVE-2026-3854 is an improper neutralization flaw (CWE-77) in GitHub Enterprise Server in which user-supplied git push option values are placed into internal service headers without sanitization. An authenticated user with push access to any repository can trigger it with a single crafted git push, injecting additional metadata fields through the delimiter character used in the internal header format. Successful injection yields remote code execution on the GHES instance, giving the attacker control of the server and the code repositories it hosts. All self-hosted GHES deployments running affected builds in the 3.14 through 3.19 branches are affected; fixes are available in 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7 and 3.19.4. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the 40% EPSS score (99th percentile) indicates a high probability of exploitation within 30 days, and the flaw is not yet in CISA's KEV catalog. Do: Upgrade GitHub Enterprise Server to 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7 or 3.19.4 (or later in each branch) as a priority, given the 40% EPSS likelihood of near-term exploitation. If patching must wait, review and restrict push-access grants to trusted users and consider disabling git push options (receive.advertisePushOptions=false) since they are the injection vector. Check GHES upgrade and push-related logs for anomalous activity from accounts with push access. | 8.7 | 40% |
| large≈ tens of thousands of self-hosted GHES deployments (enterprise installs, many internet-exposed; researchers cited in coverage report ~88% of self-hosted… |
Full article384 words · extracted from helpnetsecurity.com · click to collapse
When researchers at Wiz reported an easily exploitable GitHub remote code execution flaw (CVE-2026-3854) on March 4, the company confirmed it within 40 minutes and pushed a fix to GitHub.com in under two hours.
But for too many of the thousands of organizations running GitHub Enterprise Server on their own infrastructure, the vulnerability still represents a risk.
“Our data indicates that 88% of instances are still vulnerable,” Wiz noted on Tuesday.
CVE-2026-3854
Wiz researchers discovered CVE-2026-3854 in GitHub Enterprise Server, a self-hosted version of GitHub that’s meant for organizations that need to run the platform on their own infrastructure (e.g., organizations in regulated industries).
They found that, with a single git push command, this vulnerability can be exploited by authenticated users to execute arbitrary commands on GitHub’s backend servers.
Wiz’s technical run-down offers more specific insight on how the vulnerability can be leveraged, but the gist for users is this: on GitHub.com, it allowed remote code execution on shared storage nodes, and on GitHub Enterprise Server, it grants full server compromise, which means access to all hosted repositories and internal secrets.
A single git push compromises GitHub’s internal infrastructure (Source: Wiz)
“We confirmed that millions of public and private repositories belonging to other users and organizations were accessible on the affected nodes,” the researchers explained.
Following Wiz’s report, GitHub checked for evidence of execution of an anomalous code path that would point to attackers’ having exploited this vulnerability, but found none.
“Every occurrence mapped to the Wiz researchers’ own testing activity,” GitHub CISO Alexis Wales shared, and asserted that “no customer data was accessed, modified, or exfiltrated as a result of this vulnerability.”
Patches are ready
CVE-2026-3854 was quickly fixed in GitHub’s cloud offerings: GitHub Enterprise Cloud, GitHub Enterprise Cloud with Enterprise Managed Users, GitHub Enterprise Cloud with Data Residency, and github.com.
The company also developed fixes for supported GitHub Enterprise Server versions – from v3.14 to 3.20.
“We strongly recommend upgrading to the latest patch release as soon as possible,” the company urged, and advised organizations using the on-prem solution to review the audit log (/var/log/github-audit.log) for push operations containing ; in push options, which would point to exploitation.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/04/29/cve-2026-3854-github-rce-vulnerability/