# Wiz's Atlas AI Vulnerability Researcher Uncovers Critical GitHub RCE (CVE-2026-3854) and 200+ Unknown OSS Vulnerabilities

> Wiz's Atlas, a multi-agent autonomous AI vulnerability-research system that ranks #1 on the CyberGym benchmark (90.9%), was instrumental in discovering CVE-2026-3854 — a critical git-push option injection flaw in GitHub's internal 'X-Stat' service header that let any authenticated user with push access achieve remote code execution on GitHub.com and GitHub Enterprise Server backend infrastructure, earning one of the largest bug bounties in GitHub's history. Atlas has since been pointed at grpc, dnsmasq, Kubernetes, gVisor, the Linux kernel, and containerd, surfacing 200+ previously unknown, still-undisclosed vulnerabilities.

- **Published:** 2026-07-28T00:00:00Z
- **Last reviewed:** 2026-10-06T12:20:58.949Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1743
- **ID:** TL-2026-1743
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-3854

## Description

On 2026-03-04, Wiz Research (researcher Sagi Tzadik) discovered CVE-2026-3854, a command-injection vulnerability (CWE-77) in GitHub's internal git processing pipeline. GitHub's git-push handling spans four internal components: 'babeld,' a git proxy that is the entry point for all git operations and forwards SSH connections while constructing internal security headers; 'gitauth,' an authentication service that returns security policies such as file-size limits and branch rules; 'gitrpcd,' an RPC server that parses the X-Stat header using last-write-wins semantics for duplicate keys; and the pre-receive hook itself, a compiled Go binary that enforces policy before a push is accepted. The root cause: babeld copies user-controlled `git push -o` (push option) key-value strings directly into the X-Stat header without sanitizing semicolon characters, which the header format uses as field delimiters. Because gitrpcd resolves duplicate fields with last-write-wins semantics, an attacker's push option value such as `git push -o 'x;large_blob_rejection_enabled=bool:false'` breaks out of its own field and injects arbitrary additional X-Stat fields that override legitimate internal security parameters — including `rails_env`, `custom_hooks_dir`, `repo_pre_receive_hooks`, and `large_blob_rejection_enabled`. Researchers first mapped which X-Stat fields were injectable using AI-augmented reverse engineering (IDA MCP) against babeld's and gitrpcd's compiled binaries, reconstructing the internal header protocol without manual analysis.

The full exploit chain requires only a standard git client and push access to any single repository (including a self-created one): (1) inject a non-production `rails_env` value to switch the pre-receive hook from its sandboxed to its unsandboxed execution path; (2) inject `custom_hooks_dir` to control the base directory used for hook-script lookups; (3) inject a `repo_pre_receive_hooks` entry containing a path-traversal sequence (e.g. `../../bin/bash`) that resolves against the attacker-controlled directory; the unsandboxed path then executes that binary as the `git` service user, yielding remote code execution on GitHub's backend.

Impact differed by deployment: on GitHub.com/GitHub Enterprise Cloud, an additional injectable X-Stat field — an 'enterprise mode' boolean that defaults to false and normally blocks custom hooks on multi-tenant infrastructure — was also found to be attacker-controllable, enabling the same full RCE chain via standard `git push` commands rather than enumeration alone. Because the compromised `git` service user's filesystem permissions on shared GitHub.com storage nodes allow reading any repository on the node regardless of owning organization or user, this gave read access to the contents of millions of other customers' repositories, not merely their existence. On GitHub Enterprise Server (GHES), the same chain achieved full server compromise, including all hosted repositories and internal secrets. NVD/GitHub rate the flaw CVSS v3.1 8.8 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) / CVSS v4.0 8.7; Wiz and GitHub's own characterization of the bug as a 'critical RCE' reflects the real-world blast radius (full backend/secret compromise) rather than the raw CVSS band.

GitHub deployed a fix to GitHub.com and GitHub Enterprise Cloud within hours of the report on 2026-03-04. CVE-2026-3854 was formally assigned and GHES patches (3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, 3.19.3, later superseded by 3.14.25/3.15.20/3.16.16/3.17.13/3.18.7-8/3.19.4/3.20.0+) were released on 2026-03-10. Public technical disclosure followed on 2026-04-28; at that point roughly 88% of internet-facing GHES instances remained unpatched. GitHub's CISO, Alexis Wales, publicly acknowledged the finding as rare enough to earn 'one of the highest rewards available' in GitHub's Bug Bounty program history. There is no evidence CVE-2026-3854 was exploited maliciously in the wild before disclosure, and it does not appear in the CISA KEV catalog.

Wiz's 2026-07-27 'Introducing Atlas' post revealed that an early version of Atlas — a collaborative system of specialized AI agents (not a single frontier model) orchestrating models including OpenAI's ChatGPT/GPT-5.5 family and Anthropic's Claude Opus for different sub-tasks — was used in the GitHub discovery, alongside AI-augmented reverse engineering (via 'IDA MCP' tooling) to analyze GitHub's closed-source compiled binaries, described as 'one of the first critical vulnerabilities discovered in closed-source binaries using AI.' Atlas's pipeline runs four stages: attack-surface mapping via code property graphs, parallel hypothesis-driven hunting, adversarial validation (agents argue for/against a finding, a third arbitrates, duplicates collapse), and dynamic proof (building execution environments and running triggering inputs to confirm real bugs rather than model-generated suspicion). Atlas ranks #1 on CyberGym (1,507 benchmark instances derived from real OSS-Fuzz vulnerabilities across 188 projects) at 90.9% success, ahead of Anthropic's Mythos (83%) and OpenAI's GPT-5.5 Cyber (85%). Wiz was acquired by Google for $32B in March 2026 and has since worked with Google teams including DeepMind to improve Atlas, alongside complementary Google tools CodeMender and Gemini 3.5 Flash Cyber. Pointed at heavily-audited open-source infrastructure — grpc, dnsmasq, Kubernetes, gVisor, the Linux kernel, and containerd — Atlas has surfaced 200+ previously unknown vulnerabilities; Wiz states it is responsibly disclosing each to maintainers and withholding technical details until fixes are available, so no further CVEs, versions, or specifics for these 200+ findings are public yet.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1574 Hijack Execution Flow
- T1611 Escape to Host
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1574 Hijack Execution Flow
- T1685 Disable or Modify Tools
- T1552 Unsecured Credentials
- T1083 File and Directory Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1213.003 Data from Information Repositories

## Sources

- [Introducing Atlas: Wiz's AI vulnerability researcher](https://www.wiz.io/blog/atlas-ai-vulnerability-researcher)
- [GitHub RCE Vulnerability: CVE-2026-3854 Breakdown](https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854)
- [CVE-2026-3854 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-3854)
- [CVE-2026-3854 · GitHub Advisory Database (GHSA-64fw-jx9p-5j24)](https://github.com/advisories/GHSA-64fw-jx9p-5j24)
- [Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push](https://thehackernews.com/2026/04/researchers-discover-critical-github.html)
- [Critical GitHub RCE bug exposed millions of repositories](https://www.csoonline.com/article/4164925/critical-github-rce-bug-exposed-millions-of-repositories.html)
- [Wiz hands GitHub AI-aided bug report that isn't total slop](https://www.theregister.com/2026/04/29/github_woah_a_genuinely_helpful/)
- [Reverse Engineering With AI Unearths High-Severity GitHub Bug](https://www.darkreading.com/application-security/reverse-engineering-ai-unearths-high-severity-github-bug)
- [GitHub Enterprise Server RCE (CVE-2026-3854)](https://orca.security/resources/blog/github-enterprise-server-rce-cve-2026-3854-injection/)
- [Emerging Threat: (CVE-2026-3854) GitHub Enterprise Server RCE via Git Push Injection](https://www.cycognito.com/blog/emerging-threat-cve-2026-3854-github-enterprise-server-rce-via-git-push-injection/)
- [Critical GitHub RCE Vulnerability CVE-2026-3854 Allows Arbitrary Commands](https://rhisac.org/threat-intelligence/critical-github-rce-vulnerability-cve-2026-3854-allows-arbitrary-commands/)
- [Wiz And Google Have An Answer To Mythos, And It's Not A Model](https://www.forbes.com/sites/timkeary/2026/07/27/wiz-and-google-have-an-answer-to-mythos-and-its-not-a-model/)
- [CyberGym: Evaluating AI Agents' Real-World Cybersecurity Capabilities at Scale](https://arxiv.org/html/2506.02548v2)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1743