CVE-2026-104608— Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service

Quick assessment

Affected

GitHub Enterprise Server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 GitHub Enterprise Server 的 Git 服务（babeld）中发现了一个远程代码执行漏洞。babeld 在调用 SSH 库时持有了对内部集合的引用，而可重入的回调函数可能修改这些集合，导致引用失效。拥有账户并具备 SSH 访问权限的攻击者可利用此“释放后使用”（use-after-free）漏洞实现受控写入，从而以 babeld 身份执行任意命令，包括泄露其环境变量中的敏感密钥。利用该漏洞需要针对每个构建的内存偏移量；失败的尝试会导致 babeld 崩溃。该漏洞影响所有早于 3.23 版本

CVSS 7.7 · High Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service

Source: CVE Program / CVE List V5

Vulnerability Description

A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment secrets. Exploitation required per-build memory offsets; failed attempts crashed babeld. This affected all releases prior to 3.23 and was fixed in 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

释放后使用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
GitHub	Enterprise Server	3.19.0 ~ 3.19.*	-

II. Public POCs for CVE-2026-104608

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-104608

请登录查看更多情报信息。

Other References for CVE-2026-104608 (4)

https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14 release-notes
https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8 release-notes
https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3 release-notes
https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10 release-notes

https://www.cve.org/CVERecord?id=CVE-2026-104608

Same Patch Batch · GitHub · 2026-11-03 · 3 CVEs total

CVE-2026-118237	5.3 MEDIUM	Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process
CVE-2026-110288	5.3 MEDIUM	Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of s

IV. Related Vulnerabilities

Same product: Enterprise Server

Same vendor: GitHub

Same weakness: CWE-416