CVE-2026-19118 Overview
CVE-2026-19118 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in GitHub Enterprise Server that allows remote code execution. The flaw resides in how the server validates and processes concurrent upload requests, permitting an authenticated attacker to win a timing window and execute arbitrary code. Exploitation requires an authenticated user with write access to a repository and precise timing of concurrent requests. The issue was reported through the GitHub Bug Bounty program and is tracked as [CWE-367]. It affects all GitHub Enterprise Server versions prior to 3.22 and is fixed in 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5.
Critical Impact
A successful race win grants remote code execution on the GitHub Enterprise Server appliance, exposing source code, secrets, CI/CD pipelines, and downstream software supply chains.
Affected Products
- GitHub Enterprise Server versions prior to 3.17.20
- GitHub Enterprise Server 3.18.x prior to 3.18.14, 3.19.x prior to 3.19.11, and 3.20.x prior to 3.20.7
- GitHub Enterprise Server 3.21.x prior to 3.21.5
Discovery Timeline
- 2026-09-01 - CVE-2026-19118 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-19118
Vulnerability Analysis
The vulnerability is a TOCTOU race condition in the upload handling logic of GitHub Enterprise Server. The server performs a security or state check on an uploaded artifact and then, in a later step, uses that artifact under the assumption the check remains valid. An attacker who issues carefully interleaved concurrent upload requests can substitute or modify the artifact between the check and its use. When the substitution is timed correctly, the server processes attacker-controlled data along a code path that leads to remote code execution.
Because the exploit relies on winning a timing window rather than a memory corruption primitive, the attacker's payload runs within existing application logic and inherits the privileges of the GitHub Enterprise Server process. This class of flaw is documented as [CWE-367] Time-of-Check Time-of-Use Race Condition.
Root Cause
The root cause is non-atomic handling of uploaded objects. Validation of upload state occurs before the server commits the object for processing, and no lock or immutable snapshot binds the validated state to the state consumed downstream. Concurrent requests can therefore mutate the target between the check and the use.
Attack Vector
Exploitation is remote over the network but requires an authenticated account with write access to a repository on the target GitHub Enterprise Server instance. The attacker must issue concurrent upload requests with precise timing to win the race. No user interaction is required beyond the attacker's own automated requests. Refer to the GitHub Enterprise Release Notes 3.21.5 for vendor-published details.
No verified proof-of-concept code is publicly available. See the vendor release notes
referenced above for the official technical description of the fix.
Detection Methods for CVE-2026-19118
Indicators of Compromise
- Bursts of concurrent upload requests from a single authenticated user to the same repository or artifact endpoint within a very short time window.
- Unexpected child processes spawned by GitHub Enterprise Server application workers, particularly shells, interpreters, or network utilities.
- New or modified files in application directories that do not correspond to a legitimate release or administrator action.
- Outbound network connections from the appliance to unfamiliar hosts following upload activity.
Detection Strategies
- Correlate authenticated API activity with process-execution telemetry on the appliance to surface upload sequences immediately followed by unexpected command execution.
- Baseline normal upload concurrency per user and alert when concurrency or request-rate exceeds that baseline against a single repository.
- Review audit logs for repositories where a single user issued repeated overlapping upload requests targeting identical object paths.
Monitoring Recommendations
- Forward GitHub Enterprise Server audit, system, and process logs to a centralized SIEM or data lake for retention and correlation.
- Monitor egress traffic from the appliance for anomalous destinations, especially immediately after write-scope API activity.
- Track appliance version and patch level continuously to confirm all nodes are running a fixed release.
How to Mitigate CVE-2026-19118
Immediate Actions Required
- Upgrade every GitHub Enterprise Server instance to a fixed version: 3.17.20, 3.18.14, 3.19.11, 3.20.7, or 3.21.5.
- Audit accounts with repository write access and remove or rotate credentials for accounts that are unused, stale, or over-privileged.
- Review audit logs for anomalous concurrent upload activity preceding the patch window and investigate any hits.
Patch Information
GitHub has released fixes in GitHub Enterprise Server 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. All versions prior to 3.22 that are earlier than these releases remain vulnerable. Administrators should consult the vendor release notes for each branch: 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5.
Workarounds
- No vendor-supplied workaround is documented; patching is the required remediation.
- Reduce exposure by restricting repository write permissions to trusted users until the appliance is upgraded.
- Place the GitHub Enterprise Server management interfaces behind network controls that limit who can reach upload endpoints.
# Verify the installed GitHub Enterprise Server version on the appliance
ghe-version
# Example: apply an upgrade package staged on the appliance
ghe-upgrade /path/to/github-enterprise-<fixed-version>.pkg
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
