HOMEVULNERABILITIESCVE-2026-3854
HIGH

CVE-2026-3854

CWE-77Published: March 10, 2026· Updated: Mar 12, 2026

8.8
CVSS v3.1
EPSS:0.51%probability of exploitation in 30 daysPercentile:66.2th

Official Description

An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote code execution on the instance. During a git push operation, user-supplied push option values were not properly sanitized before being included in internal service headers. Because the internal header format used a delimiter character that could also appear in user input, an attacker could inject additional metadata fields through crafted push option values. This vulnerability was reported via the GitHub Bug Bounty program and has been fixed in GitHub Enterprise Server versions 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 and 3.19.3.

NVD Source

Technical Analysis

CVE-2026-3854 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorNetwork
Attack ComplexityLow
Privileges Req.Low
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Vendors & Products

GitHub1 product
enterprise server
Source: NVD CPE · 1 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
External links open in a new tab. Always verify in a controlled environment before use.

News & Research Mentioning CVE-2026-3854

GitHub fixes RCE flaw that gave access to millions of private repos
BleepingComputer· Apr 29, 2026

In early March, GitHub patched a critical remote code execution vulnerability (CVE-2026-3854) that could have allowed attackers to access millions of private repositories. [...] [xlite_meta score:58 src:BleepingComputer xlite_fp:b0ed52d4aecd72936299a7586ddc6387502ab304d3ed752098f87a1b5beb9e7a]

Critical GitHub Vulnerability Exposed Millions of Repositories
SecurityWeek· Apr 29, 2026

The remote code execution flaw CVE-2026-3854 was found to impact GitHub.com and GitHub Enterprise Server. The post Critical GitHub Vulnerability Exposed Millions of Repositories appeared first on SecurityWeek. [xlite_meta score:53 src:SecurityWeek xlite_fp:7738294c74a50d3433c0018d78ea8fe7d71aea8468154d71767a95a5a9e87e68]

Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push
The Hacker News· Apr 28, 2026

Cybersecurity researchers have disclosed details of a critical security vulnerability impacting GitHub.com and GitHub Enterprise Server that could allow an authenticated user to obtain remote code execution with a single "git push" command. The flaw, tracked as CVE-2026-3854 (CVSS score: 8.7), is a case of command injection that could allow an attacker with push access to a repository to achieve [xlite_meta score:56 src:The Hacker News xlite_fp:6ad050a5d55a7c07a83855d2b73bb7f41ee84586675368299b393b39466820d8]

All References (6)

Quick Facts

CVE IDCVE-2026-3854
CVSS Score8.8 / 10
SeverityHIGH
WeaknessCWE-77
CISA KEVNo
EPSS (30d)0.51%
Affected1 vendor
PublishedMar 10, 2026

Known Threat Actors

wa
financial
B0
financial
pear
financial
core
financial
J
financial

Related CVEs (CWE-77)

Recommended Actions

  • Apply vendor patches immediately
  • Monitor CVE-2026-3854 in threat intel feeds
  • Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.