CVE-2024-2469 is a high severity (CVSS 8.0) flaw in GitHub Enterprise Server. An attacker with the Administrator role could gain SSH root access through remote code execution. It was fixed in 3.8.17, 3.9.12, 3.10.9, 3.11.7 and 3.12.1.
What's affected
GitHub Enterprise Server version 3.8.0 and above, per the record. The fixed releases are:
- 3.8.17
- 3.9.12
- 3.10.9
- 3.11.7
- 3.12.1
Severity agrees across the sources. The NVD record gives 8.0, and GitHub's 3.12.1 release notes label the issue HIGH. GitHub says it was reported through the Bug Bounty program. The record does not state whether 3.13 and later are affected, so check the release notes for your series.
A sibling issue, CVE-2024-2443, was fixed in the same releases.
How to check if you're exposed
Read the appliance version from the Management Console or the site admin footer. If it is 3.8.0 or later and below the fixed release for its series, it is affected.
Then count your site administrators. The attack starts from the Administrator role, so the people who hold it set your practical exposure.
What to do now
- Upgrade to the fixed release for your series, or to a current supported release.
- Audit site administrators and remove the role from anyone who does not need it.
- Require strong authentication for administrators, and review their recent activity in the audit log.
- Limit network access to administrative endpoints.
- Retire discontinued series. GitHub documentation says 3.12 is no longer supported.
Why it matters
The record gives the weakness as CWE-20, improper input validation. In a typical case, administrator input is trusted more than it should be, so a feature meant for configuration becomes a way to run code on the underlying host.
An administrator is already powerful, so you may ask why this one counts. The difference is the layer. An application administrator can act inside GitHub. Root on the appliance can read the machine's files, services and stored secrets, which is a much bigger prize and breaks the separation the product is built to keep.
Neither the record nor the release notes say this was exploited, and it is not on the CISA Known Exploited Vulnerabilities list.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks your own repositories for vulnerable open source packages, which complements patching the platform that hosts them.
Quick check
Do I need to be an administrator to exploit this?
Yes. The record describes an attacker with the Administrator role.
Which version should I install?
The fixed release for your series: 3.8.17, 3.9.12, 3.10.9, 3.11.7 or 3.12.1, or a later supported release.
Sources
- GitHub Enterprise Server 3.12 release notes
- NVD record for CVE-2024-2469
Last reviewed: 19 October 2026.
