Github Enterprise Server vulnerabilities

CVE-2024-1354 [HIGH] CWE-20 CVE-2024-1354: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacke A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via the `syslog-ng` configuration file. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Conso

CVE-2024-2469 [HIGH] CWE-20 CVE-2024-2469: An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via re An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.17, 3.9.12, 3.10.9, 3.11.7 and 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program.

CVE-2026-15996 [HIGH] CWE-674 CVE-2026-15996: A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthe A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameters. Because request parameters were parsed before routing

CVE-2025-3509 [HIGH] CWE-94 CVE-2025-3509: A Remote Code Execution (RCE) vulnerability was identified in GitHub Enterprise Server that allowed A Remote Code Execution (RCE) vulnerability was identified in GitHub Enterprise Server that allowed attackers to execute arbitrary code by exploiting the pre-receive hook functionality, potentially leading to privilege escalation and system compromise. The vulnerability involves using dynamically allocated ports that become temporarily available, such as

CVE-2025-11578 [HIGH] CWE-59 CVE-2025-11578: A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an auth A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the appliance by exploiting a symlink escape in pre-receive hook environments. By crafting a malicious repository and environment, an attacker could replace system binaries during hook cleanup and exe

CVE-2024-2443 [HIGH] CWE-20 CVE-2024-2443: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacke A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when configuring GeoJSON settings. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Console wi

CVE-2024-3646 [HIGH] CWE-20 CVE-2024-3646: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacke A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the instance when configuring the chat integration. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Console

CVE-2023-6847 [HIGH] CWE-287 CVE-2023-6847: An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed a b An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed a bypass of Private Mode by using a specially crafted API request. To exploit this vulnerability, an attacker would need network access to the Enterprise Server appliance configured in Private Mode. This vulnerability affected all versions of GitHub Enterpri

CVE-2026-7541 [HIGH] CWE-770 CVE-2026-7541: A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthe A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint parsed user-controlled JSON request bodies without size or depth limits, causing excessive CPU and

CVE-2024-5746 [HIGH] CWE-918 CVE-2024-5746: A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitrary code execution capability on the GitHub Enterprise Server instance. Exploitation required authenticated access to GitHub Enterprise Server as a user with the Site Administrator role. This vulne

CVE-2024-3470 [HIGH] CWE-269 CVE-2024-3470: An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allow An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use a deploy key pertaining to an organization to bypass an organization ruleset. An attacker would require access to a valid deploy key for a repository in the organization as well as repository administrator access. This vulnerability

CVE-2026-6736 [MEDIUM] CWE-306 CVE-2026-6736: An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an un An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to create a local user account, bypassing the configured external identity provider. When external authentication was enabled, the signup endpoint did not properly enforce the authentication restriction, allowing account creation

CVE-2024-3684 [HIGH] CWE-88 CVE-2024-3684: A server side request forgery vulnerability was identified in GitHub Enterprise Server that allowed A server side request forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin access to the appliance when configuring the Artifacts & Logs and Migrations Storage. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and acc

CVE-2026-4821 [HIGH] CWE-78 CVE-2026-4821: An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Ser An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Management Console administrator to execute arbitrary OS commands via shell metacharacter injection in proxy configuration fields such as http_proxy. Exploitation of this vulnerability required access to the GitHub Enterpr

CVE-2026-1999 [MEDIUM] CWE-863 CVE-2026-1999: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to merge their own pull request into a repository without having push access by exploiting an authorization bypass in the enable_auto_merge mutation for pull requests. This issue only affected repositories that allow forking as the attack relies

CVE-2026-75101 [MEDIUM] CWE-639 CVE-2026-75101: An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any au An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to the repository name and pull request number rather than

CVE-2023-46648 [HIGH] CWE-331 CVE-2023-46648: An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed an attacker to brute force a user invitation to the GHES Management Console. To exploit this vulnerability, an attacker would need knowledge that a user invitation was pending. This vulnerability affected all versions of GitHub Enterprise Server since

CVE-2022-23741 [HIGH] CWE-863 CVE-2022-23741: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a s An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner privileges. An attacker would require an account with admin access to install a malicious GitHub App. This vulnerability was fixed in versions 3.3.17, 3.4.12, 3.5.9, and 3.6.5. This vulnerabilit

CVE-2026-9132 [MEDIUM] CWE-862 CVE-2026-9132: A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an aut A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not have access to. The Copilot pull request description diff summary endpoint accepted a cross-repository comparison range and rendered the resulting diff without verifying that the

CVE-2026-1355 [MEDIUM] CWE-862 CVE-2026-1355: A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed an att A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to upload unauthorized content to another user’s repository migration export due to a missing authorization check in the repository migration upload endpoint. By supplying the migration identifier, an attacker could overwrite or replace a victim’s