CVE-2024-3646 is a high severity command injection (CVSS 8.0) in GitHub Enterprise Server. A user with the editor role in the Management Console could gain admin SSH access while configuring the chat integration. It affected versions before 3.12 and is fixed in 3.12.2, 3.11.8, 3.10.10 and 3.9.13.
Weakness class: CWE-20.
What's affected
- Product: GitHub Enterprise Server.
- Affected: all versions before 3.12, per the record.
- Fixed: 3.12.2, 3.11.8, 3.10.10 and 3.9.13.
- Access needed: access to the instance and the editor role in the Management Console.
- Severity: High, CVSS 8.0 in the record. The 3.12.2 release notes label it HIGH, so the sources agree.
- Reported through the GitHub Bug Bounty program. The KEV flag is false.
- The same release notes also fix CVE-2024-3684, covered in a separate post.
How to check if you're exposed
- Sign in to the Management Console and read the version at the top of the dashboard, or run
ghe-versionover the administrative shell. - Compare it with the fixed releases for your series: 3.9.13, 3.10.10, 3.11.8 or 3.12.2.
- List who holds the editor role in the Management Console. The 3.12.2 release notes say the editor role has been deprecated.
- Review Management Console audit entries for chat integration changes you cannot explain.
What to do now
- Plan an upgrade to the fixed release in your series, or to a newer series.
- Before upgrading, reduce the Management Console editor list to the people who need it.
- Review chat integration settings for unexpected values.
- After upgrading, check administrative SSH access logs for unfamiliar sessions during the exposure window.
- Take a backup with GitHub Enterprise Server Backup Utilities before the upgrade.
Why it matters
The record classifies this as CWE-20, improper input validation, and describes the effect as command injection. A setting entered in the Management Console reaches a command on the appliance without proper handling, so a limited role gains a shell level capability. The jump from editor to admin SSH is the privilege escalation that sets the score.
It needs a foothold, which limits the risk: an attacker must already hold a Management Console editor account. But appliance consoles are often shared across teams, and role boundaries there are rarely reviewed. Treat the role list as an access control worth auditing.
Self hosted source control holds your code and often your deploy secrets. Staying on supported series with prompt patch releases is the main defense.
Quick check
Do I need to be on 3.12 to be safe?
No. The fix shipped in 3.9.13, 3.10.10, 3.11.8 and 3.12.2, so pick the one for your series.
Who can exploit it?
Someone with the editor role in the Management Console, per the record.
Sources
Last reviewed: 19 October 2026.
