Remote Code Execution Vulnerability in GitHub Enterprise Server

CVE-2026-104608

What is CVE-2026-104608?

A remote code execution vulnerability exists in GitHub Enterprise Server's Git service (babeld). The issue arises from references held in internal collections that can be compromised during interactions with the SSH library. When a re-entrant callback modifies a collection, it can lead to a use-after-free scenario, allowing an attacker with an account and SSH access to execute arbitrary commands as babeld. This exploitation includes the risk of disclosing sensitive environment secrets. Successful exploitation requires precise memory offsets for each build, while unsuccessful attempts may crash the babeld service. This security flaw affects all versions before 3.23 and has been addressed in updates 3.22.3, 3.21.8, 3.20.10, and 3.19.14, as documented in GitHub’s release notes.

References