Threat reportVulnerabilityTL-2026-1743
Wiz's Atlas AI Vulnerability Researcher Uncovers Critical GitHub RCE (CVE-2026-3854) and 200+ Unknown OSS Vulnerabilities
Wiz's Atlas AI Vulnerability Researcher Uncovers Critical (TL-2026-1743), also tracked as GitHub X-Stat Header Injection RCE, is a critical-severity software vulnerability scored CVSS 8.8, first published 2026-07-28 and last reviewed 2026-10-06. It has no confirmed attribution, affects GitHub GitHub Enterprise Server, references 1 CVE (CVE-2026-3854), maps to 17 MITRE ATT&CK techniques (T1005, T1059, T1068), and is covered by 9 detection rules and 32 indicators of compromise.
- CVSS
- 8.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 32Indicators of compromise
Key facts for TL-2026-1743
- Threat ID
- TL-2026-1743
- Also known as
- GitHub X-Stat Header Injection RCE
- Severity
- CRITICAL
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 32
- Updates
- 2026-10-06 · revalidated 1× · latest source
Malware and tooling in Wiz's Atlas AI Vulnerability Researcher Uncovers Critical
Malware and tooling: Atlas, CodeMender, CyberGym, IDA MCP
How Wiz's Atlas AI Vulnerability Researcher Uncovers Critical works
Wiz's Atlas, a multi-agent autonomous AI vulnerability-research system that ranks #1 on the CyberGym benchmark (90.9%), was instrumental in discovering CVE-2026-3854 — a critical git-push option injection flaw in GitHub's internal 'X-Stat' service header that let any authenticated user with push access achieve remote code execution on GitHub.com and GitHub Enterprise Server backend infrastructure, earning one of the largest bug bounties in GitHub's history. Atlas has since been pointed at grpc, dnsmasq, Kubernetes, gVisor, the Linux kernel, and containerd, surfacing 200+ previously unknown, still-undisclosed vulnerabilities.
On 2026-03-04, Wiz Research (researcher Sagi Tzadik) discovered CVE-2026-3854, a command-injection vulnerability (CWE-77) in GitHub's internal git processing pipeline. GitHub's git-push handling spans four internal components: 'babeld,' a git proxy that is the entry point for all git operations and forwards SSH connections while constructing internal security headers; 'gitauth,' an authentication service that returns security policies such as file-size limits and branch rules; 'gitrpcd,' an RPC server that parses the X-Stat header using last-write-wins semantics for duplicate keys; and the pre-receive hook itself, a compiled Go binary that enforces policy before a push is accepted. The root cause: babeld copies user-controlled `git push -o` (push option) key-value strings directly into the X-Stat header without sanitizing semicolon characters, which the header format uses as field delimiters. Because gitrpcd resolves duplicate fields with last-write-wins semantics, an attacker's push option value such as `git push -o 'x;large_blob_rejection_enabled=bool:false'` breaks out of its own field and injects arbitrary additional X-Stat fields that override legitimate internal security parameters — including `rails_env`, `custom_hooks_dir`, `repo_pre_receive_hooks`, and `large_blob_rejection_enabled`. Researchers first mapped which X-Stat fields were injectable using AI-augmented reverse engineering (IDA MCP) against babeld's and gitrpcd's compiled binaries, reconstructing the internal header protocol without manual analysis.
The full exploit chain requires only a standard git client and push access to any single repository (including a self-created one): (1) inject a non-production `rails_env` value to switch the pre-receive hook from its sandboxed to its unsandboxed execution path; (2) inject `custom_hooks_dir` to control the base directory used for hook-script lookups; (3) inject a `repo_pre_receive_hooks` entry containing a path-traversal sequence (e.g. `../../bin/bash`) that resolves against the attacker-controlled directory; the unsandboxed path then executes that binary as the `git` service user, yielding remote code execution on GitHub's backend.
Impact differed by deployment: on GitHub.com/GitHub Enterprise Cloud, an additional injectable X-Stat field — an 'enterprise mode' boolean that defaults to false and normally blocks custom hooks on multi-tenant infrastructure — was also found to be attacker-controllable, enabling the same full RCE chain via standard `git push` commands rather than enumeration alone. Because the compromised `git` service user's filesystem permissions on shared GitHub.com storage nodes allow reading any repository on the node regardless of owning organization or user, this gave read access to the contents of millions of other customers' repositories, not merely their existence. On GitHub Enterprise Server (GHES), the same chain achieved full server compromise, including all hosted repositories and internal secrets. NVD/GitHub rate the flaw CVSS v3.1 8.8 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) / CVSS v4.0 8.7; Wiz and GitHub's own characterization of the bug as a 'critical RCE' reflects the real-world blast radius (full backend/secret compromise) rather than the raw CVSS band.
GitHub deployed a fix to GitHub.com and GitHub Enterprise Cloud within hours of the report on 2026-03-04. CVE-2026-3854 was formally assigned and GHES patches (3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, 3.19.3, later superseded by 3.14.25/3.15.20/3.16.16/3.17.13/3.18.7-8/3.19.4/3.20.0+) were released on 2026-03-10. Public technical disclosure followed on 2026-04-28; at that point roughly 88% of internet-facing GHES instances remained unpatched. GitHub's CISO, Alexis Wales, publicly acknowledged the finding as rare enough to earn 'one of the highest rewards available' in GitHub's Bug Bounty program history. There is no evidence CVE-2026-3854 was exploited maliciously in the wild before disclosure, and it does not appear in the CISA KEV catalog.
Wiz's 2026-07-27 'Introducing Atlas' post revealed that an early version of Atlas — a collaborative system of specialized AI agents (not a single frontier model) orchestrating models including OpenAI's ChatGPT/GPT-5.5 family and Anthropic's Claude Opus for different sub-tasks — was used in the GitHub discovery, alongside AI-augmented reverse engineering (via 'IDA MCP' tooling) to analyze GitHub's closed-source compiled binaries, described as 'one of the first critical vulnerabilities discovered in closed-source binaries using AI.' Atlas's pipeline runs four stages: attack-surface mapping via code property graphs, parallel hypothesis-driven hunting, adversarial validation (agents argue for/against a finding, a third arbitrates, duplicates collapse), and dynamic proof (building execution environments and running triggering inputs to confirm real bugs rather than model-generated suspicion). Atlas ranks #1 on CyberGym (1,507 benchmark instances derived from real OSS-Fuzz vulnerabilities across 188 projects) at 90.9% success, ahead of Anthropic's Mythos (83%) and OpenAI's GPT-5.5 Cyber (85%). Wiz was acquired by Google for $32B in March 2026 and has since worked with Google teams including DeepMind to improve Atlas, alongside complementary Google tools CodeMender and Gemini 3.5 Flash Cyber. Pointed at heavily-audited open-source infrastructure — grpc, dnsmasq, Kubernetes, gVisor, the Linux kernel, and containerd — Atlas has surfaced 200+ previously unknown vulnerabilities; Wiz states it is responsibly disclosing each to maintainers and withholding technical details until fixes are available, so no further CVEs, versions, or specifics for these 200+ findings are public yet.
MITRE ATT&CK techniques used in TL-2026-1743
Collection
T1005 Data from Local System; T1213 Data from Information Repositories; T1213.003 Data from Information Repositories
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1611 Escape to Host
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Discovery
T1083 File and Directory Discovery
Lateral Movement
T1210 Exploitation of Remote Services
Defense Evasion
T1211 Exploitation for Stealth; T1574 Hijack Execution Flow
Credential Access
stealth
Resource Development
Reconnaissance
T1592 Gather Victim Host Information; T1595 Active Scanning
defense-impairment
Affected products and versions in Wiz's Atlas AI Vulnerability Researcher Uncovers Critical
- GitHub — GitHub Enterprise Server
Vulnerable versions: <=3.19.1
Fixed in: 3.14.24; 3.14.25; 3.15.19; 3.15.20; 3.16.15; 3.16.16; 3.17.12; 3.17.13; 3.18.6; 3.18.7 - GitHub — GitHub.com / GitHub Enterprise Cloud
Vulnerable versions: all instances prior to 2026-03-04 backend patch
Fixed in: patched server-side 2026-03-04; no version applicable
Remediation for Wiz's Atlas AI Vulnerability Researcher Uncovers Critical
Patches
- GitHub Enterprise Server 3.14.24/3.14.25
- GitHub Enterprise Server 3.15.19/3.15.20
- GitHub Enterprise Server 3.16.15/3.16.16
- GitHub Enterprise Server 3.17.12/3.17.13
- GitHub Enterprise Server 3.18.6/3.18.7/3.18.8
- GitHub Enterprise Server 3.19.3/3.19.4
- GitHub Enterprise Server 3.20.0+
- GitHub.com / GitHub Enterprise Cloud patched server-side 2026-03-04 (no customer action required)
Immediate actions
- Upgrade GitHub Enterprise Server to a patched release: 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.8, 3.19.4, or 3.20.0+
- Audit GHES instance logs for anomalous git push operations containing semicolon-delimited push-option values
- Review pre-receive hook directories and hook configurations for unexpected paths or binaries introduced before patching
Workarounds
- Restrict repository push access to trusted, vetted accounts on any not-yet-patched GHES instance
- Disable or closely monitor pre-receive hook customization on unpatched GHES instances until upgraded
Longer-term hardening
- Harden internal service-to-service header parsing to reject or escape delimiter characters in any field populated from user-controlled input
- Apply strict input validation/allow-listing to all git push option values before they cross any internal trust boundary
- Segment multi-tenant backend storage so a single-node RCE cannot enumerate cross-tenant repository data
- Adopt AI-augmented vulnerability research (e.g. Atlas-style multi-agent pipelines) as a continuous internal review layer for closed-source and heavily-audited open-source components
CVEs associated with Wiz's Atlas AI Vulnerability Researcher Uncovers Critical
Weaknesses (CWE) in Wiz's Atlas AI Vulnerability Researcher Uncovers Critical
Timeline of Wiz's Atlas AI Vulnerability Researcher Uncovers Critical
- GitHub deploys a fix to GitHub.com and GitHub Enterprise Cloud within hours of the report; no customer action required.
- Wiz researcher Sagi Tzadik discovers CVE-2026-3854 and confirms working RCE against GitHub Enterprise Server 3.19.1; reports it to GitHub.
- CVE-2026-3854 is formally assigned and the first round of GitHub Enterprise Server patched versions (3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, 3.19.3) is released.
- GitHub's telemetry review concludes the vulnerable code path was triggered only by Wiz's own testing; no customer data was accessed, modified or exfiltrated. GitHub.com was fixed about 75 minutes after the 2026-03-04 report (~17:45 UTC report, ~19:00 UTC fix).
- Wiz and GitHub publicly disclose full technical details of CVE-2026-3854 (X-Stat header injection, exploit chain, impact); GitHub Advisory GHSA-64fw-jx9p-5j24 updated; roughly 88% of internet-facing GHES instances remain unpatched at this point.
- Independent security outlets (The Hacker News, The Register, Dark Reading, CSO Online, Orca Security, CyCognito, RH-ISAC) publish analyses of CVE-2026-3854 and its cross-tenant/shared-storage-node impact.
- NVD record for CVE-2026-3854 last modified, reflecting CVSS v3.1 8.8 and CVSS v4.0 8.7 scoring.
- GitHub CISO Alexis Wales publicly confirms the CVE-2026-3854 finding earned one of the highest rewards in GitHub's Bug Bounty program history.
- Wiz publishes 'Introducing Atlas,' revealing that an early version of its multi-agent AI vulnerability-research system was used to discover CVE-2026-3854, and that Atlas has since found 200+ previously unknown vulnerabilities across grpc, dnsmasq, Kubernetes, gVisor, the Linux kernel, and containerd (disclosure to maintainers ongoing, details withheld pending fixes).
- Seqrite publishes an analysis of the X-Stat delimiter-injection primitive and the babeld/gitrpcd trust-boundary failure, classifying the flaw as CWE-74 in addition to CWE-77.
Update history for TL-2026-1743
- 2026-10-06 — CVE-2026-3854: Git Push Options Metadata Injection (X-Stat Delimiter Confusion) Leading to RCE in GitHub Enterprise Server: What changed No field escalation. The newer report restates the known facts and adds classification, hunting and forensic detail. New indicators (4) GHES audit log path /var/log/github-audit.log, the semicolon-in-push-option hunting signatu
Sources cited for Wiz's Atlas AI Vulnerability Researcher Uncovers Critical
- Introducing Atlas: Wiz's AI vulnerability researcher
- GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
- CVE-2026-3854 Detail
- CVE-2026-3854 · GitHub Advisory Database (GHSA-64fw-jx9p-5j24)
- Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push
- Critical GitHub RCE bug exposed millions of repositories
- Wiz hands GitHub AI-aided bug report that isn't total slop
- Reverse Engineering With AI Unearths High-Severity GitHub Bug
- GitHub Enterprise Server RCE (CVE-2026-3854)
- Emerging Threat: (CVE-2026-3854) GitHub Enterprise Server RCE via Git Push Injection
- Critical GitHub RCE Vulnerability CVE-2026-3854 Allows Arbitrary Commands
- Wiz And Google Have An Answer To Mythos, And It's Not A Model
- CyberGym: Evaluating AI Agents' Real-World Cybersecurity Capabilities at Scale
Detection coverage for TL-2026-1743
As of 2026-10-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1743 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.