Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

wiz.io

Post reply on HN
Print view View original

61–70 of 97 posts

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#61

Post by jamesfinlayson »

brianmcnulty wrote: post #21
bananapub wrote: post #4

> April 28, 2026 > GitHub Enterprise Server customers should upgrade immediately - at the time of this writing, our data indicates that 88% of instances are still vulnerable > Upgrade to GHES version 3.19.3 or later https://docs.github.com/en/enterprise-server@3.19/admin/rele... : > Enterprise Server 3.19.3 - March 10, 2026 88% of on-prem customers haven't applied a critical security fix from 7 weeks ago, that seems…

I assume a fair amount of these on-prem customers restrict access to their GHES instance to be behind corporate VPN or something similar and are planning a date to upgrade their instance that won't affect operations. Any public instance should update immediately though, it's not very hard to put together how to repro the vulnerability on your own from what they provide in the article and the fact that GitHub Enterpri…

For sure - the last company I worked at that had GitHub Enterprise had it running on a private network only accessible within the company.

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#62

Post by asa977 »

latchkey wrote: post #2

People keep wanting to replace GitHub, but with what? If GH is getting RCE's this late in the game who wants to take the chance something else won't?

We moved from github to a self-hosted forgejo instance about 6 months ago, works like a charm. Still can't belive how snappy forgejo is / laggy github has become

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#63

Post by esseph »

skrrtww wrote: post #39
embedding-shape wrote: post #24

Earlier quoted context omitted.

> solely to take advantage of its free CI, while that lasts Eh, if you want to be able to continue working, deploy and what not as normal during weekdays, I'd suggest also moving to Forgejo Actions if you're moving anyways. Not 100% compatible, but more or less the same, and even paying the same but with dedicated hardware you'd get way faster runners.

For companies with resources for infrastructure, sure. For OSS, the unlimited free minutes of multiplatform CI offered by GitHub are literally impossible to replace. Maintaining runners yourself to do the same things would be somewhere between a part- and full-time job.

> https://docs.codeberg.org/ci/

"Codeberg is a non-profit, community-led effort that provides services to free and open-source projects, such as Git hosting (using Forgejo), Pages, CI/CD and a Weblate instance."

Never say impossible.

Github is still "new" to a lot of us. OSS existed well before it, and will continue to exist well after.

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#64

Post by latchkey »

asa977 wrote: post #62
latchkey wrote: post #2

People keep wanting to replace GitHub, but with what? If GH is getting RCE's this late in the game who wants to take the chance something else won't?

We moved from github to a self-hosted forgejo instance about 6 months ago, works like a charm. Still can't belive how snappy forgejo is / laggy github has become

Is it public or locked down?

https://news.ycombinator.com/item?id=47941590

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#65

Post by saghm »

> When babeld forwards a push request, one of the internal requests includes push options in the X-Stat header. Git push options are arbitrary strings that users can pass with git push -o. They are a standard git protocol feature, intended for server-side hints. babeld encodes them as numbered fields - push_option_0, push_option_1, and so on - alongside a push_option_count.

> babeld copies git push option values directly into the X-Stat header - without sanitizing semicolons. Since ; is the X-Stat field delimiter, any semicolon in a push option value breaks out of its designated field and creates new, attacker-controlled fields.

They managed to literally do the simplest possible thing wrong. The fruit was hanging so low it might have been underground.

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#66

Post by technion »

bananapub wrote: post #4

> April 28, 2026 > GitHub Enterprise Server customers should upgrade immediately - at the time of this writing, our data indicates that 88% of instances are still vulnerable > Upgrade to GHES version 3.19.3 or later https://docs.github.com/en/enterprise-server@3.19/admin/rele... : > Enterprise Server 3.19.3 - March 10, 2026 88% of on-prem customers haven't applied a critical security fix from 7 weeks ago, that seems…

I guess I woukd say youre fortunate to have not worked in a "we cannot use github.com because we take security very seriously" environment. Because always tells me you'll be running a on prem product that might get updated once a year.

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#67

Post by odie5533 »

slopinthebag wrote: post #59
latchkey wrote: post #55

Earlier quoted context omitted.

24/7 devops team for github? Come on mate...

Is running a small forgejo instance for a team the same as running GitHub?

Will I have to patch machines, keep packages updated, deal with SSL certs, maintain action runner infra, deal with billing for the machines, add monitoring, alerts, logging, etc

No, I don't want to be in the business of running my own Github clone. That's what I pay Github for.

Why do you pay salary to employees to buy food when you can just run a farm next to the office and save money by operating the farm and giving the employees food directly? You'd save money by not having to pay as high of salaries, and farms don't even need 24/7 devops teams.

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#68

Post by altmanaltman »

odie5533 wrote: post #67
slopinthebag wrote: post #59

Earlier quoted context omitted.

Is running a small forgejo instance for a team the same as running GitHub?

Will I have to patch machines, keep packages updated, deal with SSL certs, maintain action runner infra, deal with billing for the machines, add monitoring, alerts, logging, etc No, I don't want to be in the business of running my own Github clone. That's what I pay Github for. Why do you pay salary to employees to buy food when you can just run a farm next to the office and save money by operating the farm and givin…

Don't you think the farm example was a bit too extreme for it to make sense? A tech company probably does not have expertise in farming but devOps is something they already know how to do and can easily manage it in-house. Also how fast do you think farms produce food that you can drip feed it to employees constantly

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#69

Post by irishcoffee »

saghm wrote: post #65

> When babeld forwards a push request, one of the internal requests includes push options in the X-Stat header. Git push options are arbitrary strings that users can pass with git push -o. They are a standard git protocol feature, intended for server-side hints. babeld encodes them as numbered fields - push_option_0, push_option_1, and so on - alongside a push_option_count. > babeld copies git push option values dire…

Oh Bobby Tables, your mom was quite clever.

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#70

Post by fastest963 »

jamesfinlayson wrote: post #61
brianmcnulty wrote: post #21

Earlier quoted context omitted.

I assume a fair amount of these on-prem customers restrict access to their GHES instance to be behind corporate VPN or something similar and are planning a date to upgrade their instance that won't affect operations. Any public instance should update immediately though, it's not very hard to put together how to repro the vulnerability on your own from what they provide in the article and the fact that GitHub Enterpri…

For sure - the last company I worked at that had GitHub Enterprise had it running on a private network only accessible within the company.

Yeah, but this still gives any employee RCE on the GHES server right?
Post reply on HN