# GitHub.com & GitHub Enterprise Server Pre-Auth RCE via X-Stat Header Field Injection (CVE-2026-3854)

> Wiz Research disclosed CVE-2026-3854 (CVSS 8.7) on 2026-04-28: an authenticated remote code execution flaw in GitHub.com and GitHub Enterprise Server. babeld embeds user-controlled git push option values into the internal X-Stat header without sanitizing semicolons, letting attackers inject additional key=value fields that override security-critical parameters (rails_env, custom_hooks_dir, repo_pre_receive_hooks). Chained with path traversal in custom-hook resolution, a single git push yields code execution as the git service user — on GitHub.com landing on a shared multi-tenant storage node. GitHub.com was patched within 6 hours; 88% of GHES instances remained vulnerable at disclosure.

- **Published:** 2026-04-29T12:00:00Z
- **Last reviewed:** 2026-04-29T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0434
- **ID:** TL-2026-0434
- **Severity:** HIGH (CVSS 8.7)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-3854

## Description

CVE-2026-3854 is a critical injection vulnerability in GitHub's internal git infrastructure, disclosed publicly by Wiz Research (Sagi Tzadik et al.) on 2026-04-28. The flaw arises from inconsistent handling of a shared internal protocol — the X-Stat HTTP header — across multiple services in the git push pipeline (babeld, gitauth, gitrpcd, and the pre-receive hook binary). An authenticated user with push access to any repository can execute arbitrary commands on GitHub backend servers using nothing but a standard git client.

When a user runs `git push` over SSH, the request flows through several internal services. babeld (the git proxy) authenticates via gitauth, then constructs an internal X-Stat header containing security-critical metadata: file size limits, branch naming rules, hook execution mode, custom hook directory, and a JSON manifest of pre-receive hooks. The X-Stat header carries these fields as semicolon-delimited key=value pairs, parsed downstream into a map with last-write-wins semantics. babeld also encodes user-supplied git push options (`git push -o key=value`) as numbered fields (`push_option_0`, `push_option_1`, ..., `push_option_count`) and embeds them verbatim into the same header — without sanitizing semicolons.

Because `;` is the X-Stat field delimiter, any semicolon in a push option value escapes its designated field and creates new attacker-controlled fields. The downstream parser overwrites earlier (legitimate) values with later (injected) values, allowing the attacker to override security-critical fields including `rails_env` (controls whether hooks run inside the sandbox or directly), `custom_hooks_dir` (base directory for hook script lookup), `repo_pre_receive_hooks` (JSON definitions of pre-receive hooks), `large_blob_rejection_enabled`, `reject_sha_like_refs`, and `user_operator_mode`.

Wiz chained three injections to achieve RCE: (1) inject a non-production `rails_env` value to switch from the sandboxed hook execution path to the unsandboxed path that runs hooks directly as the git service user; (2) inject `custom_hooks_dir` to control the base directory where the binary looks up hook scripts; (3) inject a `repo_pre_receive_hooks` entry whose `script` field contains a path traversal sequence — the binary's path resolution joins the attacker-controlled base directory with the traversal payload, resolving to an arbitrary binary on the filesystem, which the non-production path then executes directly with no arguments and no sandbox. On GitHub.com one additional injected field (an enterprise-mode boolean defaulting to false on GitHub.com but true on GHES) was required to reach the custom-hooks code path; once flipped, the same chain executed `hostname` on GitHub.com infrastructure.

The impact differs by deployment. On GHES, exploitation grants full server compromise: code execution as the git user yields filesystem read/write, access to all hosted repositories, and visibility into internal service configuration and secrets. On GitHub.com — a multi-tenant platform — exploitation lands on a shared storage node where the git user has broad filesystem access to every repository hosted on that node. Wiz enumerated millions of repository index entries belonging to other organizations and users from two compromised nodes, validating cross-tenant exposure (without accessing any third-party repository contents).

The research was enabled by AI-augmented reverse engineering of GitHub's compiled, closed-source binaries (notably IDA MCP), making this one of the first critical vulnerabilities discovered in closed-source binaries using AI tooling. GitHub mitigated the issue on GitHub.com within 6 hours of Wiz's report, released patches across all supported GHES branches (3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, 3.19.3), and published the CVE on patch release. As of the disclosure blog (2026-04-28), Wiz's telemetry indicated 88% of internet-exposed GHES instances were still running vulnerable versions. No active exploitation has been publicly reported as of disclosure, but the trivial exploit path (single `git push` with crafted `-o` options) and high-value target (source-of-truth code platform with downstream supply-chain risk) make rapid exploit weaponization likely.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1505.003 Web Shell
- T1546 Event Triggered Execution
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1552 Unsecured Credentials
- T1552.001 Credentials In Files
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1210 Exploitation of Remote Services
- T1213 Data from Information Repositories
- T1213.003 Code Repositories
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1565 Data Manipulation
- T1565.001 Stored Data Manipulation

## Sources

- [Securing GitHub: Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server (CVE-2026-3854)](https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854)
- [GitHub Security Advisory — CVE-2026-3854](https://github.com/advisories/CVE-2026-3854)
- [GitHub Enterprise Server 3.19 release notes (3.19.3 security release)](https://docs.github.com/en/enterprise-server@3.19/admin/release-notes)
- [NVD entry for CVE-2026-3854](https://nvd.nist.gov/vuln/detail/CVE-2026-3854)
- [GitHub Security Lab blog — pre-receive hook field injection technical post-mortem](https://github.blog/security/)
- [Wiz Threat Center query for vulnerable GHES instances](https://www.wiz.io/threat-center)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0434