ghtier

Enterprise plane incidents

GitHub Enterprise Server CVEs, mostly appliance and identity-layer bugs, several reaching root or site-admin from a low starting privilege.

Fixed 2024

CVE-2024-4985: SAML auth bypass

Rated CVSS 10.0. With SAML SSO and encrypted assertions enabled, an attacker could forge a SAML response to provision or access a site administrator account, with no prior authentication required. All GHES versions before 3.13.0 were affected; fixed in 3.9.15, 3.10.12, 3.11.10, and 3.12.4. Site admin means every repository, secret, and CI/CD pipeline on the instance. A single forged assertion reaches Tier 0 with zero credentials.

Permissions abused

Forged SAML assertion (pre-authentication)

Sources

Click to open →
Fixed 2025

CVE-2025-11578: pre-receive hook symlink escape

An authenticated enterprise admin could escape via symlink in pre-receive hook environments, replace system binaries during hook cleanup, and add an SSH key to root's authorized_keys, turning enterprise-admin access into root on the appliance itself.

Permissions abused

Enterprise admin → root via symlink escape

Sources

Click to open →
Fixed 2025

CVE-2025-3509: pre-receive hook RCE via port reuse

Pre-receive hook RCE via dynamically allocated ports available during operations such as hot-patch upgrades, requiring either site admin or a user able to modify repos with hooks already enabled.

Permissions abused

Site admin, or repo-hook-modify access, during a hot-patch window

Sources

Click to open →
Fixed 2026

CVE-2026-3854: push-option metadata RCE

Rated CVSS 8.7. A low-privileged user with push access to any repository, including one they created themselves, could inject metadata fields through crafted git push option values and achieve RCE on the instance. Notable because the starting privilege required is minimal: ordinary repo push, not admin.

Permissions abused

Repo push access (any repo, including self-created)

On the permission reference

T2Contents: Write

Sources

Click to open →
Fixed 2024

CVE-2024-1374: Management Console template injection

A Management Console editor reached root SSH on the appliance via Nomad template injection in the audit log forwarding configuration, a mid-tier admin console role escalating straight to host-level control.

Permissions abused

Management Console editor role → root

Sources

Click to open →
Fixed 2022

CVE-2022-23732: Management Console path traversal / CSRF bypass

A Management Console path traversal vulnerability bypassed CSRF protections, leading to privilege escalation on the appliance.

Permissions abused

Management Console path traversal bypassing CSRF

Sources

Click to open →