{"id":"INC-github-bmpybhnrky3x","kind":"incident","aliases":[],"related":[],"title":"GitHub: Intermittent failures in runner group and runner-related permissions pages","description":"On August 18, 2026, between 05:02 UTC and 11:30 UTC, customers were unable to view or manage Actions Runners and Runner Groups through the GitHub UI and API. The issue was caused by failures in backend requests reading runner and runner group data. The failures were caused by an expired authentication certificate unique to this service. The certificate had been rotated in KeyVault, but a step to enable use at runtime had been paused to prevent recurrence of previous incidents triggered by this operation. The impact was mitigated by completing the enablement of the new certificate in the backend system. We have added additional monitoring to this and other certificates. This service is also in the process of being replaced as part of our availability and scale work, bringing this authentication path and secret management in line with patterns across all GitHub services.","summary":"GitHub had an outage from 05:02 to 11:30 UTC on August 18, 2026, where Actions Runner and Runner Group pages and APIs failed. The cause was an expired internal authentication certificate, and no attacker access is described.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"GitHub","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ci","git","github","github-actions","incident","security","vendor"],"not_affected_if":["no-actions-runners"],"how_to_check":null,"fix":"No customer action is described; GitHub restored service by enabling the rotated certificate.","status":"resolved","published_at":"2026-08-18T07:40:35+00:00","first_seen_at":"2026-10-23T19:12:22+00:00","triaged_at":"2026-10-23T21:53:00+00:00","updated_at":"2026-10-23T21:53:00+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T21:53:00Z","model":"claude-haiku-5-5","output":{"fix":"No customer action is described; GitHub restored service by enabling the rotated certificate.","reach":"internet","impact":"low","summary":"GitHub had an outage from 05:02 to 11:30 UTC on August 18, 2026, where Actions Runner and Runner Group pages and APIs failed. The cause was an expired internal authentication certificate, and no attacker access is described.","category":"vendor","who_cares":["github","github-actions","ci"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Customers lose ability to view or manage runners during the outage window","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":["no-actions-runners"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000436,"input_tokens":2944,"output_tokens":284,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'02':33B,72C '05':32B,71C '11':35B,75C '18':40B,68C '2026':41B,69C '30':36B,76C 'access':63B 'across':207C 'action':23B,43B,85C 'add':170C 'addit':171C 'also':181C 'api':50B,95C 'attack':62B 'august':39B,67C 'authent':58B,118C,198C 'avail':192C 'backend':103C,166C 'bmpybhnrky3x':16A 'bring':196C 'caus':53B,99C,114C 'certif':59B,119C,125C,163C,177C 'ci':18B 'complet':157C 'custom':78C 'data':110C 'describ':65B 'enabl':135C,159C 'expir':56B,117C 'fail':51B 'failur':3A,101C,112C 'git':19B 'github':1A,15A,17A,20B,22B,27B,92C,209C 'github-act':21B 'group':6A,47B,89C,109C 'impact':153C 'inc':14A 'inc-github-bmpybhnrky3x':13A 'incid':24B,147C 'intermitt':2A 'intern':57B 'issu':97C 'keyvault':130C 'line':204C 'manag':84C,202C 'mitig':155C 'monitor':172C 'new':162C 'oper':151C 'outag':30B 'page':12A,48B 'part':189C 'path':199C 'pattern':206C 'paus':141C 'permiss':11A 'prevent':143C 'previous':146C 'process':184C 'read':105C 'recurr':144C 'relat':10A 'replac':187C 'request':104C 'rotat':128C 'runner':5A,9A,44B,46B,86C,88C,106C,108C 'runner-rel':8A 'runtim':138C 'scale':194C 'secret':201C 'secur':25B 'servic':123C,179C,210C 'step':133C 'system':167C 'trigger':148C 'ui':93C 'unabl':80C 'uniqu':120C 'use':136C 'utc':37B,73C,77C 'vendor':26B 'view':82C 'work':195C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-18T07:40:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"github:bmpybhnrky3x","url":"https://stspg.io/98zqb1k9jh0x","severity":"medium","published_at":"2026-08-18T07:40:35+00:00","modified_at":"2026-08-24T05:56:24+00:00","first_seen_at":"2026-10-23T19:12:22+00:00","fetched_at":"2026-10-25T20:33:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}