May 8, 2026·9 min readA Single git push Was All It Took: CVE-2026-3854Any authenticated user with push access to any repo on your GitHub Enterprise Server could RCE the server with one crafted push option. Here's exactly how.#security#git#vulnerability#github