{"id":14214,"date":"2026-05-01T15:30:37","date_gmt":"2026-05-01T15:30:37","guid":{"rendered":"https:\/\/www.securitytoday.de\/2026\/05\/08\/cve-2026-3854-github-enterprise-rce-git-push-patch-pflicht\/"},"modified":"2026-07-09T16:48:20","modified_gmt":"2026-07-09T16:48:20","slug":"cve-2026-3854-github-enterprise-rce-git-push-patch-pflicht","status":"publish","type":"post","link":"https:\/\/www.securitytoday.de\/en\/2026\/05\/01\/cve-2026-3854-github-enterprise-rce-git-push-patch-pflicht\/","title":{"rendered":"Git Push Leads to RCE on GitHub"},"content":{"rendered":"<p><strong>On April 28, 2026, Wiz Research and GitHub disclosed details of CVE-2026-3854: a command-injection vulnerability in GitHub Enterprise Server that allows any authenticated user with push access to a repository to execute arbitrary code on the server with a single <code>git push<\/code>.<\/strong><\/p>\n<p style=\"color:#69d8ed;font-size:0.9em;margin:0 0 16px;padding:0;\">6 min read<\/p>\n<div style=\"background:#003340;color:#fff;padding:32px 36px;margin:32px 0;border-radius:8px;\">\n<p style=\"margin:0 0 18px 0;font-size:0.95em;font-weight:800;text-transform:uppercase;letter-spacing:0.2em;color:#69d8ed;border-bottom:2px solid rgba(105,216,237,0.25);padding-bottom:12px;\">Key Takeaways<\/p>\n<ul style=\"margin:0;padding-left:22px;color:rgba(255,255,255,0.92);line-height:1.6;\">\n<li style=\"margin-bottom:12px;\"><strong style=\"color:#69d8ed;\">CVSS 8.7 \u2013 one <code>git push<\/code> is all it takes.<\/strong> Any user with push access to a repository \u2013 even one they created \u2013 can execute arbitrary commands on the GitHub Enterprise Server. No exploit kit, just a standard Git client.<\/li>\n<li style=\"margin-bottom:12px;\"><strong style=\"color:#69d8ed;\">Command-injection in push-option handling.<\/strong> Push-option values were not sufficiently sanitized before processing. An attacker can inject additional metadata fields into internal service headers via a delimiter character.<\/li>\n<li style=\"margin-bottom:12px;\"><strong style=\"color:#69d8ed;\">GitHub.com was patched within hours.<\/strong> Wiz Research discovered the flaw on March 4, 2026, and reported it to GitHub the same day. Patch on GitHub.com: March 4. GHES patches: March 10. Public disclosure: April 28, 2026.<\/li>\n<li style=\"color:rgba(255,255,255,0.92);\"><strong style=\"color:#69d8ed;\">Patches available for all supported GHES versions.<\/strong> 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4, 3.20.0 and higher. Older versions no longer receive support.<\/li>\n<\/ul>\n<\/div>\n<h2>How the Attack Works: Why a <code>git push<\/code> Leads to RCE<\/h2>\n<p style=\"line-height:1.8;\">Git push operations support so-called push options \u2013 custom key-value pairs that pass metadata with the push. GitHub Enterprise Server processed these values in an internal protocol without sufficiently escaping the delimiter character. Because this delimiter can appear in user input, crafted push-option values can inject additional header fields into the internal communication.<\/p>\n<p style=\"line-height:1.8;\">The result is code execution on the server \u2013 not in the repository layer, but in the backend service that processes the push. Wiz Research notes the attack is fully reproducible with a standard Git client. No special tooling, no pre-existing vulnerability, no elevated authorization beyond push access to a repository.<\/p>\n<p style=\"line-height:1.8;\">The attack scenario thus has a low barrier to entry: any external contributor, any employee with repository access, or any compromised account can exploit this flaw. In enterprise environments with large-scale self-hosted GitHub deployments, the attack radius is substantial.<\/p>\n<h2>Disclosure Timeline: What Happened Between March and April<\/h2>\n<p style=\"line-height:1.8;\"><strong>March 4, 2026:<\/strong> Wiz Research discovers and responsibly reports the flaw to GitHub. GitHub deploys a fix on GitHub.com within hours.<\/p>\n<p style=\"line-height:1.8;\"><strong>March 10, 2026:<\/strong> Patches for all supported GitHub Enterprise Server versions are released: 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4, 3.20.0. CVE-2026-3854 is assigned CVSS 8.7.<\/p>\n<p style=\"line-height:1.8;\"><strong>April 28, 2026:<\/strong> Public disclosure following coordinated vulnerability disclosure. At this point, Help Net Security research shows 88 percent of self-hosted instances remain unpatched \u2013 nearly seven weeks after fixes were available.<\/p>\n<div style=\"background:#0a2a35;border-left:3px solid #69d8ed;padding:18px 22px;margin:28px 0;border-radius:0 6px 6px 0;\">\n<p style=\"margin:0;color:rgba(255,255,255,0.9);font-size:1.05em;line-height:1.6;\"><strong style=\"color:#69d8ed;\">88 percent unpatched.<\/strong> Seven weeks after the GHES patch, nearly every self-hosted instance still runs the vulnerable version. This isn\u2019t an outlier \u2013 it\u2019s the norm in enterprise Git infrastructure.<\/p>\n<\/div>\n<h2>What Security Teams in the DACH Region Need to Do Right Now<\/h2>\n<p style=\"line-height:1.8;\"><strong>1. Check your GHES version immediately.<\/strong> Currently patched minimum versions: 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4, 3.20.0. Any version below or prior to 3.14 is unsupported and requires an upgrade.<\/p>\n<p style=\"line-height:1.8;\"><strong>2. Audit repository access rights.<\/strong> Who has push access to which repositories? External contributors, outdated service accounts, temporary credentials? Each of these accounts represents a potential attack vector \u2013 regardless of whether the repository is public or internal.<\/p>\n<p style=\"line-height:1.8;\"><strong>3. Review server logs for anomalies.<\/strong> GitHub provides logging for push operations. Unusual push option values, pushes from unknown IP addresses, or activity at atypical times should be escalated for manual review.<\/p>\n<p style=\"line-height:1.8;\"><strong>4. Verify network-layer controls.<\/strong> The GHES admin port (8443) and internal service endpoints should not be exposed to the public internet. This doesn\u2019t eliminate risk entirely, but raises the barrier for external attackers.<\/p>\n<h2>Frequently Asked Questions About CVE-2026-3854<\/h2>\n<p class=\"st-faq-hint\">Every question is locked. A tap unlocks the answer.<\/p>\n<details>\n<summary><strong>Does CVE-2026-3854 affect GitHub.com or only self-hosted instances?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Both were impacted. GitHub.com deployed a fix within hours of Wiz Research\u2019s responsible disclosure on March 4, 2026. Users of GitHub.com have been protected since then. The risk remains solely with organizations running their own GitHub Enterprise Server instances that haven\u2019t yet upgraded to the patched versions.<\/p>\n<\/details>\n<details>\n<summary><strong>Should all repositories on a GHES server be considered compromised?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">That depends on whether the vulnerability was actively exploited. A patch closes the attack vector but doesn\u2019t remediate prior compromise. Organizations with sensitive code \u2013 infrastructure-as-code, credentials in repositories, CI\/CD pipeline configurations \u2013 should inspect Git history and server logs for suspicious activity since March 2026. When in doubt: initiate your incident response process.<\/p>\n<\/details>\n<details>\n<summary><strong>Can GitHub Actions or CI\/CD pipelines exploit the vulnerability?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Yes. Any automated component executing Git push operations \u2013 Actions workflows, CI\/CD runners, deployment scripts \u2013 becomes a potential attack vector if running on a vulnerable GHES instance. Of particular concern: external runners with access to multiple repositories, especially if their credentials may have been compromised.<\/p>\n<\/details>\n<details>\n<summary><strong>How does this differ from the supply-chain vulnerability in the Bitwarden CLI GitHub Action?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">CVE-2026-3854 is a server-side vulnerability \u2013 the attack targets the GitHub Enterprise Server itself. The Bitwarden CLI GitHub Action flaw is a supply-chain attack via external dependencies in pipelines. Both are critical, but require different mitigations: patch management for CVE-2026-3854, dependency pinning and SBOM processes for supply-chain risks.<\/p>\n<\/details>\n<div style=\"background:#f0f9fa;border-radius:8px;padding:20px 24px;margin:24px 0;border-top:3px solid #69d8ed;\">\n<!--ST-LOWER-CARDS lang=en--><\/p>\n<h3 style=\"margin:48px 0 18px;padding-left:12px;font-size:1.05em;font-weight:800;color:#e6e3da;border-left:3px solid #69d8ed;line-height:1.2;\">Editor&#8217;s Picks<\/h3>\n<p><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/04\/29\/litellm-cve-2026-42208-unauthorized-database-access\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:inset 0 1px 0 rgba(230,227,218,0.06),0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/04\/litellm-cve-ki-proxy-security-250x167.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">LiteLLM CVE-2026-42208: Unauthorized Database Access<\/span><\/span><\/a><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/04\/29\/beprime-breach-lack-of-mfa-causes-data-leak\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:inset 0 1px 0 rgba(230,227,218,0.06),0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/04\/beprime-breach-cybersecurity-cover-250x167.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">BePrime Breach: Lack of MFA Causes Data Leak<\/span><\/span><\/a><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/04\/28\/bitwarden-cli-checkmarx-github-action-supply-chain-devsecops\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:inset 0 1px 0 rgba(230,227,218,0.06),0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/04\/st-hero-17489157-250x167.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Bitwarden CLI Hit by GitHub Actions Supply Chain<\/span><\/span><\/a><\/p>\n<h3 style=\"margin:48px 0 18px;padding-left:12px;font-size:1.05em;font-weight:800;color:#e6e3da;border-left:3px solid #69d8ed;line-height:1.2;\">More from the MBF Media Network<\/h3>\n<p><a href=\"https:\/\/www.digital-chiefs.de\/en\/gartner-1-3-billionen-halbleiterumsatz-2026-cio-ki-chip-it\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:inset 0 1px 0 rgba(230,227,218,0.06),0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-gartner-1-3-billionen-halbleiterumsatz-2-86748192-250x143.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#e8828d;margin-bottom:5px;\">Digital Chiefs<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Gartner Flags Chip Shortage for CIOs<\/span><\/span><\/a><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/05\/01\/openai-models-on-aws-dach-teams-in\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:inset 0 1px 0 rgba(230,227,218,0.06),0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-openai-modelle-auf-amazon-bedrock-was-de-915103.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#0bb7fd;margin-bottom:5px;\">cloudmagazin<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">OpenAI Models on AWS: DACH Teams in<\/span><\/span><\/a><a href=\"https:\/\/mybusinessfuture.com\/en\/eu-requires-labeling-obligations-for-sme-2026\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:inset 0 1px 0 rgba(230,227,218,0.06),0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-eu-ai-act-2026-kennzeichnungspflichten-m-35346140-250x143.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#aa8ac2;margin-bottom:5px;\">MyBusinessFuture<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">EU AI Act from August 2026: What labelling obligations really affect SMEs<\/span><\/span><\/a><!--\/ST-LOWER-CARDS--><\/p>\n","protected":false},"excerpt":{"rendered":"CVE-2026-3854 (CVSS 8.7): GitHub Enterprise RCE via git push. 88% of self-hosted instances unpatched. Patches available since March 10th.","protected":false},"author":55,"featured_media":13790,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"CVE","_yoast_wpseo_title":"Git Push Leads to RCE on GitHub","_yoast_wpseo_metadesc":"CVE-2026-3854 (CVSS 8.7): RCE in GitHub Enterprise Server via a single git push\u201488% of instances remain unpatched. What security teams must do now.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/05\/cve-2026-3854-github-enterprise-rce-git-push-patch-pflicht-april-2026-cover-hero.jpg","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/05\/cve-2026-3854-github-enterprise-rce-git-push-patch-pflicht-april-2026-cover-hero.jpg","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[255],"tags":[],"class_list":["post-14214","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-praxis-umsetzung-en"],"evm_reading_time_minutes":5,"wpml_language":"en","wpml_translation_of":13780,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/14214","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=14214"}],"version-history":[{"count":6,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/14214\/revisions"}],"predecessor-version":[{"id":21431,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/14214\/revisions\/21431"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/13790"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=14214"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=14214"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=14214"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}