CVE-2024-1378 is a critical (CVSS 9.1) command injection in GitHub Enterprise Server. A user with the editor role in the Management Console could gain admin SSH access to the appliance through nomad templates when configuring SMTP options. Fixed in 3.8.15, 3.9.10, 3.10.7 and 3.11.5. Upgrade to one of those or a later release.
What's affected
The NVD record says all versions of GitHub Enterprise Server prior to 3.12 were affected. GitHub fixed the issue in four release lines:
- 3.11 line: fixed in 3.11.5
- 3.10 line: fixed in 3.10.7
- 3.9 line: fixed in 3.9.10
- 3.8 line: fixed in 3.8.15
The record lists the vendor release notes for each of those versions as its references. The record does not say which exact earlier releases are vulnerable beyond "prior to 3.12", so read the release notes for your line before you decide how urgent your upgrade is.
Exploitation required access to the GitHub Enterprise Server instance and the editor role in the Management Console. This is not a bug that an anonymous internet user can reach on its own.
How to check if you're exposed
GitHub Enterprise Server is an appliance, so there is no package manager query. Use the version shown in the Management Console, or the version your administrators track for the appliance, and compare it with the fixed releases above.
Also review who holds the editor role in the Management Console. The weakness needs that role, so a short list of editors lowers the practical risk while you schedule the upgrade. Check the Management Console access list and the audit trail for unexpected SMTP configuration changes.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Find your appliance version and release line.
- Upgrade to 3.8.15, 3.9.10, 3.10.7, 3.11.5 or a later release in your line, following GitHub's upgrade documentation.
- Review the list of Management Console editors and remove anyone who does not need the role.
- Review recent changes to SMTP settings and confirm they were intended.
- If your line is no longer supported, plan a move to a supported release rather than waiting for a backport.
Why it matters
The record classes the weakness as CWE-77, command injection, together with CWE-20, improper input validation. Values entered in a settings form ended up in a template that the appliance used to run a service, so crafted input could change what ran.
The impact is high because the result was SSH access with administrator rights on the appliance that hosts your source code. The privilege needed is also high, which is why the score is 9.1 and not higher. The record's vector shows a changed scope, meaning the damage reaches beyond the Management Console itself. The record does not mark this CVE as known exploited, and GitHub's advisory text says it was reported through its bug bounty program.
Quick check
Do I need to worry if I only use GitHub.com?
The record names GitHub Enterprise Server only. GitHub.com is not listed as affected.
Is this CVE on the CISA KEV list?
No. The record's KEV flag is false, and nothing in the record says it was exploited in the wild.
Sources
- GitHub Enterprise Server 3.11.5 release notes (listed in the NVD record, not retrieved)
- GitHub Enterprise Server 3.10.7 release notes (listed in the NVD record, not retrieved)
- GitHub Enterprise Server 3.9.10 release notes (listed in the NVD record, not retrieved)
- GitHub Enterprise Server 3.8.15 release notes (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1378
Last reviewed: 19 October 2026.
