{"id":"CVE-2026-104608","title":"Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service","summary":"A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a…","severity":"high","cvss":7.7,"cvssVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-416","CWE-1265"],"vendor":"GitHub","product":"Enterprise Server","affected":["enterprise_server >= 3.19.0 < 3.19.*","enterprise_server >= 3.20.0 < 3.20.*","enterprise_server >= 3.21.0 < 3.21.*","enterprise_server >= 3.22.0 < 3.22.*"],"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T22:49:48.079Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104608","references":[{"url":"https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14"},{"url":"https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10"},{"url":"https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8"},{"url":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3"}],"tags":["cve.org"],"epss":0.004,"epssPercentile":0.34495,"ingestedAt":"2026-11-05T20:33:06.607Z","slug":"CVE-2026-104608","body":"## Overview\n\nA remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment secrets. Exploitation required per-build memory offsets; failed attempts crashed babeld. This affected all releases prior to 3.23 and was fixed in 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.\n\n## Affected\n\n- `enterprise_server >= 3.19.0 < 3.19.*`\n- `enterprise_server >= 3.20.0 < 3.20.*`\n- `enterprise_server >= 3.21.0 < 3.21.*`\n- `enterprise_server >= 3.22.0 < 3.22.*`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}