If you use GitHub at your company or manage code repositories, this news is of great interest to you. Security researchers have discovered a critical vulnerability in GitHub.com and GitHub Enterprise Server that allowed any authenticated user to execute code remotely on GitHub’s own servers. And the most unsettling part is how easy it was: you only had to do a simple git push.
The flaw has been catalogued as CVE-2026-3854 with a CVSS score of 8.7, placing it in the critical category. The cross-tenant access risk was real: an attacker could have accessed repositories of other organisations or users without anyone noticing. The good news is that GitHub has already released the corresponding patch, although if your company uses GitHub Enterprise Server, you should verify that you’re on the latest version as soon as possible.
This type of vulnerability is a reminder that no platform, no matter how large, is free of security flaws. The speed with which GitHub has responded is appreciated, but the fact that the exploit was so simple to execute makes the story especially striking. Keeping systems updated remains, to this day, the most effective security measure and also the most ignored one.
Article published on 29 April 2026 | Technology blog
