CVE-2026-104608 Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service

Description

A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment secrets. Exploitation required per-build memory offsets; failed attempts crashed babeld. This affected all releases prior to 3.23 and was fixed in 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.

Exploitable remotely over the network, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector

Network

Attack complexity

High

Attack requirements

None

Privileges required

Low

Interaction

None

Confidentiality

High

Integrity

High

Availability

High

Confidentiality of other systems

Low

Integrity of other systems

None

Availability of other systems

None

Affected products and versions