GitHub Enterprise CVE-2026-3854: a single git push, RCE on the backend

A Single Git Push, Arbitrary Code Execution

On April 28, 2026, Wiz Research published the disclosure for CVE-2026-3854, a critical remote code execution vulnerability in the internal git infrastructure that powers both GitHub.com and GitHub Enterprise Server. The mechanic is the kind of finding that makes every infrastructure-security team rethink their patch cadence: any authenticated user, with nothing more than a standard git push and a crafted push-option value, could execute arbitrary commands on the GitHub backend.

The vulnerability lives in how push options — the key-value strings sent during a git push operation — were processed by GitHub’s internal protocol layer. User-supplied push-option values were not properly sanitized before being included in internal service headers. The injection point sits below the user-facing API and above the service mesh, in a part of the stack the average platform engineer never thinks about. The CVSS score landed at 8.7 (Wiz) / 8.8 (other trackers) — high-impact across confidentiality, integrity, and availability.

Wiz reported the bug to GitHub on March 4, 2026. GitHub deployed the fix to GitHub.com the same day. Public disclosure followed on April 28, with the GHES patch (3.19.3) released alongside. GitHub’s forensic investigation found no evidence of pre-disclosure abuse on GitHub.com — but for self-hosted GHES customers, the disclosure-day picture was less reassuring: Wiz’s scan data indicated 88% of GHES instances were still on a vulnerable version at the moment the vulnerability went public.

That 88% number is the story. The CVE itself is fixable in an afternoon. The 88% is the operational gap that turns a patch-the-server problem into an industry-scale incident.

Why Repo-Platform RCEs Are a Class Shift

Source-control RCE is not a new category, but the 2026 threat model makes it materially worse than the same finding would have been five years ago. Three structural reasons:

• The auth boundary now sits inside the dev tool. A 2026 GHES instance authenticates against SSO, ingests CI/CD secrets, signs container images, runs GitHub Actions, integrates with Copilot Enterprise, and brokers MCP tool access. RCE on the GHES backend is not just code execution on a build server — it is code execution at the auth boundary that gates virtually everything downstream.
• CI runner credential blast radius keeps growing. A modern GitHub Actions workflow holds GitHub OIDC tokens, cloud provider credentials, package registry tokens, container registry credentials, secret-manager tokens, and observability vendor keys. RCE on the platform that issues those tokens shortcuts every supply-chain compromise we have written about over the previous twelve months.
• AI coding agents widen the dependency graph. Cursor, Claude Code, Copilot, and the in-IDE agents push and pull code through the GHES instance at a pace humans don’t review. The frequency at which the platform handles authenticated push operations from automated agents has gone up by an order of magnitude. The frequency at which a vulnerable push-option path could be triggered has gone up with it.

Repo-platform RCEs are now infrastructure-platform RCEs. The “patch the dev tool” framing undersells what’s actually at stake.

The Seven-Step Response Playbook

Teams that ran the GHES 3.19.3 patch in the first 48 hours after disclosure shared a written response playbook. The seven steps:

1. Inventory affected GHES instances. Every GHES install in the org, including pre-prod and air-gapped clones. The 88% number is partially explained by inventory drift — instances stood up for a project two years ago and forgotten. Inventory is the gate every other step depends on.

2. Isolate. Restrict ingress to the GHES web port and the SSH port at the network layer for any instance you cannot patch within the next two hours. The vulnerability requires an authenticated user but does not require any special privilege; reducing the authenticated-user pool to known operators is a cheap mitigation while the patch rolls.

3. Patch to GHES 3.19.3 (or later). The fix is a sanitization patch in the push-options handling path, shipped in 3.19.3 for the 3.19 line. For older GHES versions still in support, GitHub published the corresponding back-ported patches alongside the 3.19.3 release. Patch in maintenance windows, but treat this as a P1 — there is no rate-limit knob that meaningfully reduces exploitability.

4. Rotate credentials in priority order. GitHub OIDC tokens, GHES admin PATs, organization-level webhook secrets, container registry tokens issued via GHES, package registry tokens (npm Enterprise, GitHub Packages), and any cloud provider credential whose trust path crosses the GHES OIDC issuer. The rotation order matters because some rotations gate others — rotating the GHES admin PAT before rotating the cloud OIDC trust policy leaves you locked out of the cloud rotation step.

5. Verify with reproducible patching evidence. After the patch lands, query the GHES /api/v3/meta endpoint, verify the version string, and audit the patch artifact’s hash against the GitHub-published SHA. Any unexpected delta is a signal that the patch did not actually land in the customer-visible binary path.

6. Scan the audit log for retroactive evidence. Pre-disclosure exploitation on GHES instances is plausible, even if GitHub.com showed clean forensics. Query the GHES audit log for anomalous push-option values across the last 90 days, anomalous Actions runner spawn patterns, anomalous OIDC token issuance patterns, and any administrative action whose actor doesn’t match a known operator. Stop the search at the first anomaly and escalate to a full IR scope, not at “we didn’t find anything obvious.”

7. Report. Internal IT, security committee, and any customer-facing surface where GHES is part of the supply chain. The Bitwarden public-advisory pattern from April 22 is the template: what was affected, what window, what was rotated, what customers should do.

Most of the seven steps are mechanical; what kills response time is the inventory step and the audit-log scan. The teams that closed the response loop in 48 hours had both pre-existing — they did not start either from scratch when the CVE landed.

See the IAN team run on your cloud. We connect to your AWS account via a scoped read-only role, run the Observe-tier agents, and leave you with a concrete audit report — cost waste, security exposure, compliance gaps, and a labor-offset estimate. You keep the findings regardless of next steps. Get a free infrastructure audit →

What Tooling Helps and Where It Falls Short

The 2026 source-control security tooling landscape covers parts of the response well: GitHub Advanced Security, Endor Labs, Snyk, and Socket all detect a portion of the dependency-side blast radius. Wiz, Snyk Cloud, and Lacework can map cross-tenant blast radius across the cloud accounts a compromised GHES instance trusts. The CISA KEV process and the GitHub Security Advisory Database close the disclosure loop quickly.

Where the tooling landscape is still thin is on the GHES-instance side of the response: the inventory query, the patch verification, the audit-log scan, and the orchestration of the seven-step playbook against the customer’s actual GHES topology. Detection without the response orchestration produces alerts the security team has no clean way to act on — the security team becomes the human runbook executor for every CVE in this class.

Three things in particular are hard to wire up with off-the-shelf tooling:

• A live inventory of every GHES instance, including pre-prod and forgotten clones. The inventory question often crosses team boundaries (platform team owns prod GHES, an internal-tools team owns the developer-experience GHES, a research team has a research-GHES standup nobody else knows about).
• Pre-authorized credential-rotation paths. Rotating the GHES OIDC trust policy in the cloud account requires admin access to the cloud account; in many organizations that requires a separate approval cycle in the middle of an incident, which is exactly when the cycle is hardest to run.
• An audit trail of every credential, every Actions run, and every administrative action that crossed the disclosure window. The GHES audit log is rich, but it is not the audit trail your IR team needs across cloud accounts and tool-chain endpoints.

Those three live in the gap between point-tool security and operational governance. They are the work of an active operational layer, not a passive scanner.

Capability Tiers Mapped to Repo-Platform CVE Response

The Observe / Operate / Administer capability-tier model applies cleanly to repo-platform CVE response:

• Observe. Continuous GHES inventory, version monitoring, advisory ingestion (CISA KEV, GitHub Advisory Database, Wiz feeds), audit-log streaming, and OIDC trust-policy mapping. Auto-execute, fully audited. The detection and inventory steps live here.
• Operate. Patch orchestration against pre-approved patch windows, credential rotation against pre-authorized scopes, OIDC trust-policy refresh, and audit-log scan jobs. Auto-execute for reversible / scoped actions; gated when a rotation crosses an organization-wide boundary. Steps three through six of the response playbook live here.
• Administer. Customer-facing communications, root credential rotation, separation-of-duties exceptions for emergency response, and any change to the GHES OIDC issuer policy itself. Always requires explicit approval.

The mapping is the difference between a security team that scrambles for a week after a disclosure and one that contains the response inside the first 48 hours.

How IAN Helps: The Security-Agent on the Active Operational Layer

IAN is the AI DevOps team for cloud infrastructure, delivered as a coordinated team of specialized agents on the active operational layer. The security agent is one of those agents, and it is built natively for the post-CVE-2026-3854 repo-platform threat model.

The security agent runs continuous GHES inventory and version monitoring across every connected cloud account. Advisory ingestion (CISA KEV, GitHub Advisory Database, Wiz feeds, vendor security mailing lists) lands as MCP tool calls, scored against the customer’s own GHES topology, and surfaced in the audit trail with patch-applicability verdicts attached. When the next CVE in this class lands, the agent has already produced the list of affected instances, the credential-exposure map, and a draft patch-and-rotate plan.

Reversible Operate-tier actions — patch orchestration against pre-approved windows, credential rotation against pre-authorized scopes, audit-log scan jobs — execute automatically when policy permits. Irreversible or organization-wide actions escalate to the Administer tier with separation-of-duties enforced. Every action lands in the immutable audit trail, which doubles as the evidence pack for the customer-facing advisory.

Pricing is BYOK and usage-based with a monthly minimum. Customers bring their own model keys (Claude, OpenAI, or another provider) and pay inference cost directly to their model vendor. IAN charges for the orchestration layer, per agent action, per cloud account, per operation class. Usage scales with the number of repo-platform events processed, which is itself a strong signal of where the team should invest in supply-chain hardening.

The Three-Phase Rollout

Phase 1 — Stand up the repo-platform Observe layer. Wire continuous GHES inventory, version monitoring, and audit-log streaming into the security-agent’s read path across every connected cloud account. Two-to-four weeks for a team with reasonable platform-engineering capacity.

Phase 2 — Codify the response runbook. Write the seven-step playbook against the team’s specific GHES topology. Pre-authorize the credential-rotation scopes the security agent can act on. Run a tabletop exercise against the CVE-2026-3854 attack profile and measure time-to-contain. Two-to-three months of pattern tuning.

Phase 3 — Promote scoped Operate-tier actions. Let the security agent execute patch orchestration, credential rotation, and audit-log scan jobs for the reversible cases under capability-tier governance. Keep customer-facing communication and root-credential rotation gated to Administer-tier approval. Measure the time-to-contain delta against the Phase 2 baseline.

The pattern compounds. By the time Phase 3 lands, the security team is doing different work — fewer minutes scrambling for inventory and patch-status answers in the middle of a disclosure, more minutes hardening the repo-platform attack surface so the next disclosure is smaller — and the security-agent has accumulated enough audit data to make the next round of policy tuning a data exercise rather than a debate.

Get a free infrastructure audit → | See pricing →