CVE-2026-4821: 
GitHub Enterprise Server vulnerability analysis and mitigation

CVE-2026-4821 is an OS command injection vulnerability (CWE-78) in GitHub Enterprise Server (GHES) that allows an authenticated Management Console administrator to execute arbitrary OS commands by injecting shell metacharacters into proxy configuration fields (such as http_proxy) via the Management Console configuration API. The vulnerability affects all GHES versions prior to 3.21, specifically versions 3.14.0–3.14.25, 3.15.0–3.15.20, 3.16.0–3.16.16, 3.17.0–3.17.13, 3.18.0–3.18.7, 3.19.0–3.19.4, and 3.20.0. It was disclosed on April 21, 2026, and reported via the GitHub Bug Bounty program. The CVE ID has been marked as "Rejected" in the CVE database (published in error), but the underlying vulnerability is real and tracked under GHSA-6hg9-m8fv-wq83; it carries a CVSS v3.1 base score of 7.2 (High) and a CVSS v4.0 base score of 8.1 (High) (GitHub Advisory, GHES 3.20 Release Notes).

The root cause is improper neutralization of special elements used in OS commands (CWE-78), specifically in the Management Console configuration API's handling of proxy-related fields such as http_proxy. When a Management Console administrator submits configuration values containing shell metacharacters (e.g., semicolons, backticks, pipes), these characters are not sanitized before being passed to underlying OS-level command execution, allowing arbitrary commands to run as the admin OS user. Exploitation requires authenticated access to the GHES instance with Management Console administrator privileges — it is not exploitable by regular users or unauthenticated attackers. No public proof-of-concept code has been identified at the time of disclosure (GitHub Advisory, GHES 3.18 Release Notes).

Successful exploitation allows an authenticated Management Console administrator to execute arbitrary OS commands on the GHES appliance as the admin OS user, potentially resulting in complete system compromise. This includes unauthorized access to sensitive data (source code, secrets, credentials), modification of system configuration, installation of backdoors or malware, and denial of service. Given that GHES instances typically host an organization's entire source code and CI/CD infrastructure, exploitation could enable significant lateral movement and data exfiltration (GHES 3.20 Release Notes, GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.014% (0.000140), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for authenticated Management Console administrator access, which significantly limits the attacker pool to insiders or those who have already compromised admin credentials.

1. Gain Management Console Access: Obtain credentials for a Management Console administrator account on a vulnerable GHES instance (versions prior to 3.14.26, 3.15.21, 3.16.17, 3.17.14, 3.18.8, 3.19.5, or 3.20.1).
2. Access the Configuration API: Authenticate to the Management Console configuration API endpoint (e.g., https://<ghes-host>:8443/setup/api/settings) using the admin password or API token.
3. Inject Shell Metacharacters: Submit a crafted PATCH or PUT request to the configuration API, embedding shell metacharacters in a proxy configuration field such as http_proxy. For example, set the value to something like http://proxy.example.com; <malicious_command> # to inject an OS command after the legitimate proxy value.
4. Trigger Command Execution: Apply the configuration (e.g., via the Management Console UI or API), causing the GHES appliance to process the proxy settings and execute the injected OS command as the admin OS user.
5. Achieve Objective: Use the resulting command execution to establish persistence, exfiltrate data, pivot to internal systems, or escalate privileges further on the appliance (GHES 3.20 Release Notes, GHES 3.18 Release Notes).

• Logs: Unexpected entries in GHES audit logs showing Management Console configuration API calls (PATCH/PUT to /setup/api/settings) with unusual proxy field values containing shell metacharacters (;, `, |, $()).
• Logs: System logs (e.g., /var/log/syslog, /var/log/auth.log) showing unexpected command execution by the admin OS user or the GHES management process around the time of configuration changes.
• Process: Unusual child processes spawned by the GHES management or configuration service (e.g., unexpected shells, curl, wget, nc, python, or other utilities not normally invoked during configuration).
• Network: Unexpected outbound network connections from the GHES appliance to external IPs, particularly following a configuration apply operation.
• File System: New or modified files in sensitive directories (e.g., /etc/, /root/, /home/admin/, GHES application directories) created around the time of a configuration change.
• File System: Presence of new cron jobs, SSH authorized keys, or startup scripts added to the appliance that were not part of a legitimate upgrade.

GitHub has released patched versions addressing this vulnerability across all supported release lines: 3.14.26, 3.15.21, 3.16.17, 3.17.14, 3.18.8, 3.19.5, and 3.20.1. Administrators should upgrade to the appropriate patched version for their release line immediately. As interim mitigations, restrict Management Console administrator access to the minimum number of authorized personnel, enforce strong and unique credentials for Management Console accounts, and monitor audit logs for suspicious configuration API activity. Applying the principle of least privilege to admin account assignments reduces the risk of insider or credential-compromise scenarios (GHES 3.20 Release Notes, GitHub Advisory).

The vulnerability was reported to GitHub via its Bug Bounty program and disclosed alongside several other HIGH-severity fixes in the April 21, 2026 GHES security releases. The CVE ID was subsequently marked as "Rejected" in the CVE database (published in error), though the underlying vulnerability and its fix remain valid and are tracked under GHSA-6hg9-m8fv-wq83. Community aggregators including VulDB, CVEFeed, and CIRCL's vulnerability database indexed the advisory shortly after disclosure. A scanner tool (ghes-cve-scanner) was published on GitHub to help administrators identify vulnerable instances (GitHub Advisory).