CVE-2024-3470 is a medium severity improper privilege management flaw (CVSS 5.9) in GitHub Enterprise Server 3.11 and 3.12 that let a deploy key bypass an organization ruleset. It is fixed in 3.11.8 and 3.12.2. Upgrade your appliances and then review your rulesets and deploy keys.
What's affected
GitHub's record says versions 3.11 to 3.12 were affected and that the fix shipped in 3.11.8 and 3.12.2. The 3.11.8 release notes, dated April 18, 2024, list it as a MEDIUM security fix. The weakness is CWE-269 (improper privilege management). The CVSS vector in the record says the attack is reached over the network, with high attack complexity, needing high privileges and no user interaction.
The release notes describe it this way: an attacker with a deploy key for an organization owned repository could bypass a ruleset that named organization administrators as bypass actors, and exploitation requires the attacker to already hold a valid deploy key for a repository. The record adds that the attacker would also need repository administrator access, and that it was reported through the GitHub Bug Bounty program. The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
I read the 3.11 release notes. I did not open the 3.12.2 notes, so the 3.12.2 fix version comes from the NVD record.
How to check if you're exposed
On the appliance, connect over SSH and print the version, then compare it with 3.11.8 and 3.12.2.
ghe-version
Then list the deploy keys on repositories in your organizations and the rulesets that name bypass actors. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which known vulnerabilities touch the open source packages you ship.
Safeguard's reachability analysis helps with the next question, which is whether the vulnerable code is actually called in your application, so you can order the work sensibly.
What to do now
- Run ghe-version on each Enterprise Server appliance.
- Upgrade 3.11 to 3.11.8 or later, and 3.12 to 3.12.2 or later. Follow GitHub's upgrade guide for your path.
- Audit deploy keys across organization repositories and remove unused ones.
- Prefer read only deploy keys, and rotate any with write access.
- Review rulesets that list organization administrators as bypass actors.
Why it matters
A ruleset is meant to enforce a policy, such as required reviews or protected branches, for everyone who is not named as a bypass actor. This flaw let a deploy key, a credential tied to a repository and often used by automation, act as if it were covered by the bypass list for organization administrators. The class of weakness is improper privilege management: the system granted more than the credential should hold.
The conditions are narrow, which fits the medium rating. Still, deploy keys are long lived and sometimes forgotten, so this is a good time to prune them. The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
Quick check
Which GitHub Enterprise Server versions fix it?
3.11.8 for the 3.11 series and 3.12.2 for the 3.12 series, per the record and the 3.11.8 release notes.
Sources
- GitHub Enterprise Server 3.11 release notes
- GitHub Enterprise Server 3.12.2 release notes, listed in the record
- NVD record data for CVE-2024-3470
Last reviewed: 19 October 2026.
