One Git Push, Full Server Compromise: Inside GitHub Enterprise's CVE-2026-3854

A single git push was all it took. On 28 April, GitHub publicly disclosed CVE-2026-3854, a CVSS 8.7 remote code execution flaw in GitHub Enterprise Server that any authenticated user with push access could trigger. The fix shipped fast. The lesson for self-hosted code platforms is harder to patch.

What Happened

Wiz Research found the bug on 4 March 2026 and reported it to GitHub the same day. GitHub deployed a fix to GitHub.com within hours and released patches for GitHub Enterprise Server on 10 March. Details stayed private until disclosure on 28 April. The root cause sat in the pre-receive pipeline. Git push options supplied by the client were inserted into an internal X-Stat header without proper sanitisation. The header used a delimiter character that could legally appear inside user input, so an attacker could chain crafted push options to inject extra metadata fields. One of those fields, rails_env, controlled whether repository hooks ran inside a sandbox. Any value other than the production string skipped the sandbox and ran hooks directly as the git service user, with full filesystem access on the backend.

Why It Matters

This is the most exposed corner of any code platform. Push access lives with developers, contractors, build agents and, increasingly, AI coding tooling. Exploitation did not require finding a zero-click on a public-facing service; it required holding one of the dozens of legitimate write tokens already attached to a repository. Australian organisations that run GitHub Enterprise Server in their own cloud or on-premises, which is common in financial services, government, healthcare and defence-aligned vendors, should treat this as a reminder that internal source-of-truth systems carry the same blast radius as production. A compromised source platform leads to compromised builds, signed binaries and, eventually, customers.

The most dangerous attack surface is rarely the front door. It's the privileged path your build pipeline already trusts.

What Security Teams Should Do Now

• Patch GitHub Enterprise Server to version 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4 or 3.20.0 or later. GitHub.com is already remediated.

• Audit which user accounts and machine identities hold push access, and revoke any that are dormant or no longer needed.

• Review pre-receive hook configurations and any custom internal header handling in your own DevOps tooling for similar delimiter assumptions.

• Pull GHES audit logs from 4 March onward and look for unusual push-option values, abnormal X-Stat content or anomalous pre-receive hook behaviour.

• Confirm that runners, build agents and self-hosted GitHub instances sit under the same monitoring, EDR coverage and patch cadence as production hosts.

• Rotate any secrets that may have been exposed to a hook execution context during the window.

Aurian's Take

CVE-2026-3854 is a textbook case of trust boundaries collapsing inside infrastructure that organisations assume is well-defended. GitHub's own engineers caught the bug within hours of disclosure and pushed a same-day fix to the cloud product. That speed should not be confused with "no exposure window". GHES customers were vulnerable for roughly seven weeks between the patch release on 10 March and public disclosure on 28 April. Anyone running a quarterly patch cadence — still common for code-hosting infrastructure that nobody wants to break — needs to reach further back than that. The window also matters because the exploit primitive (an authenticated developer or a compromised CI token) is exactly the kind of access an attacker tries to chain to from a phished engineer or a compromised laptop.

The deeper pattern is that developer infrastructure now sits at the heart of the threat model. Code platforms, CI/CD runners, package registries and AI coding agents handle privileged secrets, sign artefacts and write to production. Aurian's penetration testing and security assurance work treats these systems as in-scope by default, because the attack paths into modern Australian businesses run through the build pipeline rather than the DMZ. Treating the developer estate like production, with the same patch SLAs, monitoring and red-team scrutiny, is no longer optional.

---

Patching CVE-2026-3854 closes one specific door. A properly run penetration test catalogues every other door your developer estate has left open.

To find out how Aurian can help your organisation assess its exposure, get in touch.