CVE-2026-19118 is a high severity (CVSS 7.5) time-of-check time-of-use race condition in GitHub Enterprise Server that allowed remote code execution by an authenticated user with repository write access. It was fixed in 3.17.20, 3.18.14, 3.19.11, 3.20.7 and 3.21.5, and in 3.22.
What's affected
GitHub's record says all versions of GitHub Enterprise Server prior to 3.22 were affected, and gives these fixed releases:
- 3.17.20
- 3.18.14
- 3.19.11
- 3.20.7
- 3.21.5
Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests. The release notes describe a race that let an attacker swap a validated upload for attacker-controlled content before the instance processed it. The notes give a High rating and no CVSS score. The 7.5 score in the record comes from NVD. The issue was reported through the GitHub Bug Bounty program, and the KEV flag is false.
A later release, 3.21.6 and its siblings, also fixes the Manage API issue CVE-2026-18730, so upgrading past these versions covers both.
How to check if you're exposed
Find the version of the appliance from the administrative shell:
ghe-version
Compare it with the fixed release for your series. Anything below the fixed release in the same series is affected, and so is any version lower than 3.22 without the backport.
Then look at who has write access to repositories. The flaw needs write access, so organizations that grant it widely, including to outside collaborators or automation accounts, have more exposure. Review the list of accounts with write access to important repositories.
What to do now
- Check your GitHub Enterprise Server version.
- Upgrade to the fixed release for your series, or to a newer one such as 3.21.6 which also fixes CVE-2026-18730.
- Take a backup before the upgrade using GitHub's backup utilities.
- Review write access to repositories and remove access that is not needed.
- Review audit logs for unusual upload activity from accounts with write access.
- Rotate secrets stored on the appliance if you suspect compromise.
Why it matters
The weakness class is CWE-367, time-of-check time-of-use. The server checks an upload, and later uses it, but an attacker can change the content in the window between the two steps. What was validated is no longer what is processed.
A race condition is hard to hit, which is why the attack complexity is high. But it can be repeated automatically until the timing works, and the result here is arbitrary code on the instance, which on a source code host is a high value target. The usual fix for this class is to validate and use the same object atomically, instead of checking and re-reading. No exploitation is reported.
Quick check
Do I need to be logged in?
Yes. An authenticated user with write access to a repository is required.
What if I run an older series than 3.17?
The record says versions prior to 3.22 were affected and lists fixes for 3.17 to 3.21. Move to a supported series.
Sources
Last reviewed: 18 October 2026.
