Quick answers
- Is CVE-2026-104608 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-104608 being exploited in the wild.
- How severe is CVE-2026-104608?
- Informational severity, published 3 November 2026.
- Which products and versions are affected?
- GitHub Enterprise Server prior to 3.23, including 3.22.x before 3.22.3, 3.21.x before 3.21.8, 3.20.x before 3.20.10, and 3.19.x before 3.19.14.
- Is there a fix for CVE-2026-104608?
- Yes: fixed in Enterprise Server 3.22.3, 3.21.8, 3.20.10, 3.19.14, and 3.23. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-104608 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-104608?
- Check whether you run GitHub Enterprise Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Enterprise Server 3.22.3, 3.21.8, 3.20.10, 3.19.14, and 3.23
Technical details
The vulnerability is a use-after-free in babeld's handling of SSH callbacks. The service holds references into internal collections while calling the SSH library, and a re-entrant callback can modify those collections and invalidate the references. An authenticated attacker with SSH access can trigger a controlled write to gain arbitrary code execution as the babeld process, including access to environment secrets. Exploitation requires knowledge of per-build memory offsets; failed attempts crash the daemon.
Affected products
- GitHub Enterprise Server prior to 3.23, including 3.22.x before 3.22.3, 3.21.x before 3.21.8, 3.20.x before 3.20.10, and 3.19.x before 3.19.14
Timeline
- 2026-11-03: disclosed