GitHub issues $100,000 bounty for critical RCE vulnerability disclosed by @sagitz_
The researcher disclosed CVE‑2026‑3854, a critical RCE flaw, prompting the largest payout in GitHub's Vulnerability Reward Program to date.
By Ryan Merket · Published
Why it matters
A six‑figure GitHub bounty for a critical RCE bug highlights the escalating stakes of supply‑chain security and signals that major platform operators are willing to invest heavily to close high‑impact vulnerabilities before they can be weaponized.
In a post on X on July 22nd, security researcher Saif Ghani (@sagitz_) announced that GitHub Security had paid a $100,000 bounty for the discovery of a remote‑code‑execution (RCE) vulnerability now catalogued as CVE‑2026‑3854. The bounty, confirmed by a thank‑you tweet from the official GitHub Security (@GitHubSecurity) account, represents one of the largest single rewards the company has issued through its Vulnerability Reward Program.
The vulnerability, detailed in a follow‑up blog post by Wiz Security, allowed an attacker to execute arbitrary commands on GitHub’s backend infrastructure by exploiting a flaw in the way GitHub processed specially crafted repository URLs. According to the Wiz analysis, the bug could be triggered without authentication, giving an adversary full control over the affected server environment. The researchers demonstrated a proof‑of‑concept that leveraged the flaw to gain shell access, then used that access to read repository secrets and alter code in transit.
GitHub assigned CVE‑2026‑3854 a severity rating of Critical in the National Vulnerability Database, noting that the flaw impacted all public and private repositories using the vulnerable endpoint. The company’s response, as outlined in its advisory, involved immediate mitigation, a patch rollout across all affected services, and a coordinated disclosure timeline with the researcher.
The $100,000 payout aligns with GitHub’s tiered bounty structure, which caps rewards for critical vulnerabilities at $150,000. Historically, the program has paid out more than $15 million in total since its launch in 2016, with top payouts ranging from $50,000 to $150,000 for zero‑day exploits that affect core platform services. While GitHub does not publicly disclose individual reward amounts, the public acknowledgment from @GitHubSecurity and the researcher’s tweet provide the only verifiable source for this particular figure.
The incident arrives at a moment when the software supply‑chain security market is tightening. Following high‑profile attacks on the past two years—most notably the 2024 compromise of a major package manager—platform operators have accelerated investments in bug‑bounty programs and automated vulnerability scanning. GitHub’s decision to award a six‑figure bounty underscores the company’s commitment to incentivizing external security research, especially for flaws that could compromise thousands of developers and organizations.
For the researcher, the payout is a tangible validation of a growing reputation in the bug‑bounty community. @sagitz_ has posted several prior findings on X, but this is the first instance where a GitHub‑level bounty has been publicly disclosed. The researcher’s concise tweet—"$100,000 in bounty 🤯 Thanks @GitHubSecurity"—resonated across the security community, earning over 7,000 likes and more than 200 retweets within hours of posting.
GitHub’s Vulnerability Reward Program, administered in partnership with HackerOne, requires reporters to follow a strict disclosure timeline. Reporters must provide a detailed proof‑of‑concept, a clear impact assessment, and a remediation recommendation before public disclosure. In this case, the researcher adhered to those guidelines, enabling GitHub to issue a patch within 48 hours of receipt.
The broader implication for the developer ecosystem is a reminder that platform‑level bugs can have cascading effects on downstream projects. An RCE vulnerability in a core service like GitHub can be leveraged to inject malicious code into any repository that clones the compromised data, potentially reaching millions of downstream users. By awarding a substantial bounty, GitHub is signaling that it will continue to allocate significant resources toward uncovering and remediating such high‑impact threats.
Key takeaways
- The $100,000 bounty for CVE‑2026‑3854 is one of the largest payouts ever recorded by GitHub’s Vulnerability Reward Program.
- The flaw allowed unauthenticated remote code execution through crafted repository URLs, affecting both public and private repositories.
- GitHub’s rapid patch deployment and public acknowledgment illustrate a mature security response process.
- The payout reinforces the industry trend toward higher rewards for critical supply‑chain vulnerabilities.
The incident also serves as a case study for other platform operators: generous, transparent bounty programs can surface sophisticated attacks before they affect customers at scale. As supply‑chain risk remains a top concern for developers, the incentive structure demonstrated here is likely to inspire similar initiatives across the tech stack.
Sources