---
id: CVE-2026-104608
title: >-
  Use-after-free vulnerability in GitHub Enterprise Server allowed remote code
  execution in the Git service
summary: >-
  A remote code execution vulnerability was identified in GitHub Enterprise
  Server in the Git service (babeld). babeld held references into internal
  collections while calling into the SSH library, where a re-entrant callback
  could modify a…
severity: high
cvss: 7.7
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-416
  - CWE-1265
vendor: GitHub
product: Enterprise Server
affected:
  - enterprise_server >= 3.19.0 < 3.19.*
  - enterprise_server >= 3.20.0 < 3.20.*
  - enterprise_server >= 3.21.0 < 3.21.*
  - enterprise_server >= 3.22.0 < 3.22.*
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:49:48.079Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-104608'
references:
  - url: >-
      https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14
  - url: >-
      https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10
  - url: >-
      https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8
  - url: >-
      https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3
tags:
  - cve.org
epss: 0.004
epssPercentile: 0.34495
ingestedAt: '2026-11-05T20:33:06.607Z'
---

## Overview

A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment secrets. Exploitation required per-build memory offsets; failed attempts crashed babeld. This affected all releases prior to 3.23 and was fixed in 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.

## Affected

- `enterprise_server >= 3.19.0 < 3.19.*`
- `enterprise_server >= 3.20.0 < 3.20.*`
- `enterprise_server >= 3.21.0 < 3.21.*`
- `enterprise_server >= 3.22.0 < 3.22.*`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.