A remote code execution vulnerability (CVE-2026-104608) was found in GitHub Enterprise Server's Git service component (babeld). The flaw involves a use-after-free condition triggered by re-entrant callbacks modifying internal collections during SSH operations. An attacker with an account and SSH access could exploit this to execute arbitrary commands as the babeld process and disclose environment secrets. Exploitation requires per-build memory offsets and failed attempts cause crashes. The issue affects all versions prior to 3.23 and was fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14.