Critical GitHub Enterprise Server flaw allows code execution

CVE-2026-3854 is a critical vulnerability in GitHub Enterprise Server. Insufficient validation of Git push options allows an attacker with ordinary repository access to execute arbitrary code on the server itself. A patch addressing the issue has been released.

What this means for your organisation

The development platform is one of the most valuable targets in any organisation. It holds the source code, the build jobs and usually the secrets that unlock the production environment. When the bar for attack is "ordinary repository access", any contractor, intern or compromised developer account is enough. The case illustrates a recurring pattern: content we treat as trusted because it comes from our own developers is not automatically safe.

Berigo recommends

• Update GitHub Enterprise Server to the patched version, ahead of other changes this week.
• Review who actually holds write access to repositories and remove access that is no longer in use.
• Check whether the build server holds production secrets that should have been separated out, and rotate them if in doubt.
• Make sure administrative events on the platform are logged, so you can look back if something surfaces later.

Source

• wiz.io