Live › vulnerability › CVE-2026-104608
A use-after-free in the babeld Git service of GitHub Enterprise Server lets an attacker with an account and SSH access turn a memory bug into arbitrary command execution. The attacker runs commands as babeld and can read its environment secrets.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:45 UTC. All times on this page are UTC.
Self-hosted GitHub Enterprise Server instances on releases prior to 3.23 are affected. The attacker needs an account on the instance and SSH access, so instances where SSH is disabled or limited to trusted users have less exposure. GitHub.com and other managed deployments are not described as affected by the sources.
No product ranges from the sources yet.
3.22.3 on the 3.22 line3.21.8 on the 3.21 line3.20.10 on the 3.20 line3.19.14 on the 3.19 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment secrets. Exploitation required per-build memory offsets; failed attempts crashed babeld. This affected all releases prior to 3.23 and was fixed in 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.
This page as .md · .json · in your agent: get_signal("CVE-2026-104608")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.