GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

Re:GitHub RCE Vulnerability: CVE-2026-3854 Breakdown by semiquaver on Tuesday April 28, 2026 @03:59PM (#47939827)

GHES is essentially unmaintained (perhaps “on life support” would be more charitable since they are certainly accepting payment for it) and has been so for about a decade. It requires a multi-hour downtime to apply even a patch-level release. They do not have any supported mechanism for HA upgrades. So even the most conscientious GHES customers lag the latest version because they can’t afford the downtime.

They are constantly telling all their GHES customers who complain about the severe flaws with the self-hosted appliance product to move to GitHub Enterprise Cloud, which is just regular GitHub.com, but who in their right mind would make that move nowadays??? At least GHES stays up during the daily github.com outages.

[ Parent | on HN ]

Re:GitHub RCE Vulnerability: CVE-2026-3854 Breakdown by baby_souffle on Tuesday April 28, 2026 @04:05PM (#47939926)

You can at least schedule the updates.

It's still a pretty annoying process, though.

[ Parent | on HN ]

Re:GitHub RCE Vulnerability: CVE-2026-3854 Breakdown by semiquaver on Tuesday April 28, 2026 @04:08PM (#47939965)

Until GHES can do zero-downtime upgrades nothing will get better. Not on their roadmap because as far as I’m aware the GHES team doesn’t actually exist or is entirely focused on KLTO. It’s a dead product that they wish didn’t exist.

[ Parent | on HN ]

Re:GitHub RCE Vulnerability: CVE-2026-3854 Breakdown by everfrustrated on Tuesday April 28, 2026 @05:00PM (#47940702)

Pretty sure GitHub Enterprise Cloud is just Github hosting their enterprise server for you on Azure so you don't have to do the patching yourself.

[ Parent | on HN ]

Re:GitHub RCE Vulnerability: CVE-2026-3854 Breakdown by semiquaver on Tuesday April 28, 2026 @05:57PM (#47941400)

It sure isn’t! GitHub Enterprise Cloud is simply an enterprise plan on the regular multitenant github.com. Your repositories are on disk right next to everyone else that uses github.com. There is no segregated storage or compute.

I wish they had a plan to literally host GHES for you because then more people in the company would be forced to reckon with how terrible GHES is from an operational perspective. It is stuck ca. 15-20 years ago conceptually.

[ Parent | on HN ]

Re:GitHub RCE Vulnerability: CVE-2026-3854 Breakdown by js2 on Wednesday April 29, 2026 @12:52AM (#47944284)

[flagged]

[ Parent | on HN ]

Re:GitHub RCE Vulnerability: CVE-2026-3854 Breakdown by securesaml on Tuesday April 28, 2026 @05:19PM (#47940951)

Github enterprise cloud is on github.com and with more features: http://github.com/account/enterprises/new

They don't host github enterprise server for you (though gitlab has something called gitlab dedicated which they host gitlab ee for you).

[ Parent | on HN ]

Re:GitHub RCE Vulnerability: CVE-2026-3854 Breakdown by Kuinox on Tuesday April 28, 2026 @06:06PM (#47941509)

Why is there an eu github status then ? https://eu.githubstatus.com/uptime

[ Parent | on HN ]

Re:GitHub RCE Vulnerability: CVE-2026-3854 Breakdown by conception on Tuesday April 28, 2026 @07:11PM (#47942126)

Data residency is a thing.

[ Parent | on HN ]

Re:GitHub RCE Vulnerability: CVE-2026-3854 Breakdown by Kuinox on Wednesday April 29, 2026 @04:07AM (#47945439)

And how would that explain the way higher SLA ?

[ Parent | on HN ]

Re:GitHub RCE Vulnerability: CVE-2026-3854 Breakdown by trashb on Wednesday April 29, 2026 @07:43AM (#47946960)

> X-Stat header that controls whether the server operates in enterprise mode.

Perhaps this header mentioned in the article is related, maybe that's the toggle for the enterprise mode? Seems there is at least traces of "enterprise mode" on the normal github servers.

[ Parent | on HN ]

Re:GitHub RCE Vulnerability: CVE-2026-3854 Breakdown by semiquaver on Wednesday April 29, 2026 @08:41AM (#47947509)

There is no “the toggle”. Read the article. A GHES appliance (and github.com) is dozens of services working together, some of which act differently in ES mode, so there are toggles galore. But probably not a lot that can be toggled by user input :(

[ Parent | on HN ]

Re:GitHub RCE Vulnerability: CVE-2026-3854 Breakdown by trashb on Monday May 04, 2026 @10:12AM (#48009042)

I did read the article and that was a direct quote from the section "From GHES to GitHub.com".

The parent comment was talking about the "GitHub Enterprise Cloud" not "GitHub Enterprise Server" which are two distinct products.

The way that they where able to escalate the RCE from a GHES environment to github.com environment is by injecting this header and enabling this enterprise feature. This supports the idea that "Github enterprise cloud is on github.com".

[ Parent | on HN ]