GitHub.com & GitHub Enterprise Server Pre-Auth RCE via X-Stat Header Field Injection (CVE-2026-3854)

GitHub.com & GitHub Enterprise Server Pre-Auth RCE via (TL-2026-0434), also tracked as GitHub X-Stat Field Injection, is a high-severity software vulnerability scored CVSS 8.7, first published 2026-04-29. It has no confirmed attribution, affects GitHub GitHub Enterprise Server, references 1 CVE (CVE-2026-3854), maps to 23 MITRE ATT&CK techniques (T1005, T1059, T1059.004), and is covered by 9 detection rules and 21 indicators of compromise.

Key facts for TL-2026-0434

Threat ID
TL-2026-0434
Also known as
GitHub X-Stat Field Injection, Wiz GHES RCE, git push -o RCE
Severity
HIGH
CVSS
8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Status
MONITORING
Category
VULNERABILITY
First published
2026-04-29
Last reviewed
2026-04-29
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
technology, software-development, financial, government, defense, healthcare, manufacturing, telecommunications, all-sectors-using-ghes
Target regions
Global, North America, Europe, Asia Pacific
Detection rules
9
Indicators of compromise
21

Malware and tooling in GitHub.com & GitHub Enterprise Server Pre-Auth RCE via

Malware and tooling: Git, GitHub, babeld, gitauth, gitrpcd

Wiz Research disclosed CVE-2026-3854 (CVSS 8.7) on 2026-04-28: an authenticated remote code execution flaw in GitHub.com and GitHub Enterprise Server. babeld embeds user-controlled git push option values into the internal X-Stat header without sanitizing semicolons, letting attackers inject additional key=value fields that override security-critical parameters (rails_env, custom_hooks_dir, repo_pre_receive_hooks). Chained with path traversal in custom-hook resolution, a single git push yields code execution as the git service user — on GitHub.com landing on a shared multi-tenant storage node. GitHub.com was patched within 6 hours; 88% of GHES instances remained vulnerable at disclosure.

How GitHub.com & GitHub Enterprise Server Pre-Auth RCE via works

CVE-2026-3854 is a critical injection vulnerability in GitHub's internal git infrastructure, disclosed publicly by Wiz Research (Sagi Tzadik et al.) on 2026-04-28. The flaw arises from inconsistent handling of a shared internal protocol — the X-Stat HTTP header — across multiple services in the git push pipeline (babeld, gitauth, gitrpcd, and the pre-receive hook binary). An authenticated user with push access to any repository can execute arbitrary commands on GitHub backend servers using nothing but a standard git client.

When a user runs `git push` over SSH, the request flows through several internal services. babeld (the git proxy) authenticates via gitauth, then constructs an internal X-Stat header containing security-critical metadata: file size limits, branch naming rules, hook execution mode, custom hook directory, and a JSON manifest of pre-receive hooks. The X-Stat header carries these fields as semicolon-delimited key=value pairs, parsed downstream into a map with last-write-wins semantics. babeld also encodes user-supplied git push options (`git push -o key=value`) as numbered fields (`push_option_0`, `push_option_1`, ..., `push_option_count`) and embeds them verbatim into the same header — without sanitizing semicolons.

Because `;` is the X-Stat field delimiter, any semicolon in a push option value escapes its designated field and creates new attacker-controlled fields. The downstream parser overwrites earlier (legitimate) values with later (injected) values, allowing the attacker to override security-critical fields including `rails_env` (controls whether hooks run inside the sandbox or directly), `custom_hooks_dir` (base directory for hook script lookup), `repo_pre_receive_hooks` (JSON definitions of pre-receive hooks), `large_blob_rejection_enabled`, `reject_sha_like_refs`, and `user_operator_mode`.

Wiz chained three injections to achieve RCE: (1) inject a non-production `rails_env` value to switch from the sandboxed hook execution path to the unsandboxed path that runs hooks directly as the git service user; (2) inject `custom_hooks_dir` to control the base directory where the binary looks up hook scripts; (3) inject a `repo_pre_receive_hooks` entry whose `script` field contains a path traversal sequence — the binary's path resolution joins the attacker-controlled base directory with the traversal payload, resolving to an arbitrary binary on the filesystem, which the non-production path then executes directly with no arguments and no sandbox. On GitHub.com one additional injected field (an enterprise-mode boolean defaulting to false on GitHub.com but true on GHES) was required to reach the custom-hooks code path; once flipped, the same chain executed `hostname` on GitHub.com infrastructure.

The impact differs by deployment. On GHES, exploitation grants full server compromise: code execution as the git user yields filesystem read/write, access to all hosted repositories, and visibility into internal service configuration and secrets. On GitHub.com — a multi-tenant platform — exploitation lands on a shared storage node where the git user has broad filesystem access to every repository hosted on that node. Wiz enumerated millions of repository index entries belonging to other organizations and users from two compromised nodes, validating cross-tenant exposure (without accessing any third-party repository contents).

The research was enabled by AI-augmented reverse engineering of GitHub's compiled, closed-source binaries (notably IDA MCP), making this one of the first critical vulnerabilities discovered in closed-source binaries using AI tooling. GitHub mitigated the issue on GitHub.com within 6 hours of Wiz's report, released patches across all supported GHES branches (3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, 3.19.3), and published the CVE on patch release. As of the disclosure blog (2026-04-28), Wiz's telemetry indicated 88% of internet-exposed GHES instances were still running vulnerable versions. No active exploitation has been publicly reported as of disclosure, but the trivial exploit path (single `git push` with crafted `-o` options) and high-value target (source-of-truth code platform with downstream supply-chain risk) make rapid exploit weaponization likely.

MITRE ATT&CK techniques used in TL-2026-0434

Collection

T1005 Data from Local System; T1213 Data from Information Repositories; T1213.003 Code Repositories

Execution

T1059 Command and Scripting Interpreter; T1059.004 Unix Shell; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Lateral Movement

T1210 Exploitation of Remote Services

Defense Evasion

T1211 Exploitation for Stealth

Persistence

T1505 Server Software Component; T1505.003 Web Shell; T1546 Event Triggered Execution

Credential Access

T1552 Unsecured Credentials; T1552.001 Credentials In Files

Impact

T1565 Data Manipulation; T1565.001 Stored Data Manipulation

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in GitHub.com & GitHub Enterprise Server Pre-Auth RCE via

  • GitHub — GitHub Enterprise Server
    Vulnerable versions: 3.14.x <= 3.14.23; 3.15.x <= 3.15.18; 3.16.x <= 3.16.14; 3.17.x <= 3.17.11; 3.18.x <= 3.18.5; 3.19.x <= 3.19.1
    Fixed in: 3.14.24; 3.15.19; 3.16.15; 3.17.12; 3.18.6; 3.19.3
  • GitHub — GitHub.com (SaaS)
    Vulnerable versions: all versions prior to 2026-03-10 server-side patch
    Fixed in: server-side mitigation deployed 2026-03-10 (within 6 hours of report)

Remediation for GitHub.com & GitHub Enterprise Server Pre-Auth RCE via

Patches

  • GitHub Enterprise Server 3.14.24
  • GitHub Enterprise Server 3.15.19
  • GitHub Enterprise Server 3.16.15
  • GitHub Enterprise Server 3.17.12
  • GitHub Enterprise Server 3.18.6
  • GitHub Enterprise Server 3.19.3
  • GitHub.com — patched server-side on 2026-03-10 (no customer action required)

Immediate actions

  • Upgrade GitHub Enterprise Server immediately to a fixed branch (3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, or 3.19.3+).
  • Restrict push access on GHES to vetted internal users until patched; remove or rotate any third-party tokens with repo write access.
  • On GitHub.com no user action is required — GitHub mitigated the flaw on 2026-03-10 within 6 hours of disclosure.
  • Audit pre-receive hook execution logs and `git/git-hooks/` directories for any unexpected scripts or directory traversal artifacts on GHES nodes.
  • Block outbound network access from GHES backend nodes to non-corporate destinations as a containment measure pending patch.

Workarounds

  • If immediate upgrade is not possible, disable the use of git push options on GHES at the proxy/SSH layer (deny `-o` / `--push-option` at the receive side).
  • Restrict GHES network exposure — place behind a VPN/IP allowlist and remove any anonymous or external collaborator push paths.
  • Disable custom pre-receive hooks org-wide until patched (removes the RCE primitive even if injection still works).
  • Monitor X-Stat header content at any reverse proxy in front of GHES and drop requests where push option values contain `;`.

Longer-term hardening

  • Adopt strict input sanitization and explicit length-prefixed encoding for any inter-service protocol that carries security-critical fields (avoid delimiter-based key=value with last-write-wins parsing).
  • Treat internal services as untrusted boundaries — gitrpcd-style services should authenticate and validate every X-Stat-equivalent field rather than trusting the upstream proxy.
  • Eliminate non-production code paths from production binaries; gate sandbox bypass on a build-time constant rather than a runtime environment variable.
  • Add path-traversal validation and chroot/jail enforcement on hook script lookup — never join a user-influenced base directory with a user-influenced script path without canonicalization checks.
  • Subscribe to GitHub's security advisory feed and align change-management to apply GHES security releases within 7 days.

CVEs associated with GitHub.com & GitHub Enterprise Server Pre-Auth RCE via

CVE-2026-3854

Weaknesses (CWE) in GitHub.com & GitHub Enterprise Server Pre-Auth RCE via

CWE-93, CWE-74, CWE-20, CWE-94, CWE-78, CWE-22, CWE-471

Timeline of GitHub.com & GitHub Enterprise Server Pre-Auth RCE via

  • Wiz Research begins second-round audit of GitHub's internal git infrastructure (babeld, gitauth, gitrpcd, pre-receive hook binary), leveraging AI-augmented reverse engineering tooling (IDA MCP) to analyze closed-source compiled binaries that previously required impractical manual effort.
  • Wiz researchers identify the X-Stat header field injection: babeld embeds git push option values verbatim into the X-Stat header without sanitizing semicolons, and downstream services parse the header with last-write-wins semantics, allowing override of security-critical fields.
  • Wiz chains injection of rails_env, custom_hooks_dir, and repo_pre_receive_hooks to bypass the pre-receive hook sandbox and execute arbitrary commands as the git service user on GHES. A second injection of the enterprise-mode flag enables the same chain on GitHub.com.
  • Wiz Research reports CVE-2026-3854 to GitHub Security via GitHub's bug bounty program, providing full proof-of-concept and binary analysis.
  • CVE-2026-3854 assigned and published with CVSS 3.1 base score 8.7. NVD entry created.
  • GitHub releases patched GHES versions 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, and 3.19.3 across all supported branches; CVE-2026-3854 published with CVSS 8.7.
  • GitHub mitigates the vulnerability on GitHub.com within 6 hours of Wiz's report — server-side mitigation, no customer action required.
  • Wiz Threat Center publishes pre-built query for vulnerable GHES instances; telemetry confirms 88% of internet-facing GHES servers remain on vulnerable versions ~7 weeks post-patch.
  • Wiz Research publishes detailed technical write-up on its blog, including the full exploitation chain, cross-tenant impact analysis on GitHub.com, and indication that 88% of internet-exposed GHES instances are still on vulnerable versions.
  • Threadlinqs Intelligence publishes full threat profile TL-2026-0434 with detection coverage and simulation data; no public exploitation observed at time of publishing.
  • As of 2026-05-29, CVE-2026-3854 is fully patched (GitHub.com mitigated in ~2hrs, all GHES branches fixed to 3.19.4/3.20.0+) and GitHub's forensics confirmed no in-the-wild abuse beyond Wiz testing. But a public PoC exists and ~88% of self-hosted GHES were unpatched at disclosure, so unpatched on-prem instances remain a live residual risk.

Sources cited for GitHub.com & GitHub Enterprise Server Pre-Auth RCE via

Threats related to GitHub.com & GitHub Enterprise Server Pre-Auth RCE via

Detection coverage for TL-2026-0434

As of 2026-04-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0434 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats