GitHub Enterprise Server remote code execution and memory disclosure flaws

Summary

Users with an account and SSH access on a GitHub Enterprise Server instance can run commands through the Git service (babeld) or read part of its process memory. All versions before 3.23 are affected, and a CSRF flaw in the Management Console can delete stored ChatOps configuration.

Affected when

• An account and SSH access to the instance
• ChatOps integrations configured and an operator signed in to the Management Console visiting attacker-controlled content

What to do

Update to the fixed version for your release line: 3.19.14, 3.20.10, 3.21.8, or 3.22.3. Version 3.23 and later are not affected.

Update to at least the version for your product:

• GitHub Enterprise Server 3.19 3.19.14 or later
• GitHub Enterprise Server 3.20 3.20.10 or later
• GitHub Enterprise Server 3.21 3.21.8 or later
• GitHub Enterprise Server 3.22 3.22.3 or later

Products and platforms

• GitHub Enterprise Server

CVE IDs

• CVE-2026-104608 (opens in a new tab)
• CVE-2026-110288 (opens in a new tab)
• CVE-2026-118237 (opens in a new tab)

Sources

• Advisory: docs.github.com (opens in a new tab) · docs.github.com (opens in a new tab) · docs.github.com (opens in a new tab) · docs.github.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)

Times

First published 2026-11-03 22:49 UTC

First seen 2026-11-09 15:20 UTC