{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/github-organization-and-enterprise/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GitHub (Organization and Enterprise)"],"_cs_severities":["high"],"_cs_tags":["saas","github","persistence","defense-evasion","access-control"],"_cs_type":"advisory","_cs_vendors":["GitHub"],"content_html":"\u003cp\u003eGitHub organizations and enterprises can utilize SSH certificate authorities (CAs) to issue short-lived SSH certificates, mandating their use in place of personal SSH keys for Git access. This configuration centralizes access control and enforces time-bounded authentication. Unauthorized modifications to these settings, specifically the creation or destruction of a CA or the disabling of certificate requirements, significantly weaken access controls. Following an account takeover, an adversary may perform these actions to authenticate using unmanaged SSH keys, bypassing the organization's intended security posture.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful unauthorized modification of SSH certificate requirements allows an adversary to authenticate to organizational repositories using persistent, unmanaged SSH keys. This weakens Git access control, bypasses centralized and time-bounded authentication policies, and provides a mechanism for sustained persistence and defense evasion.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit GitHub audit logs for \u003ccode\u003essh_certificate_authority.create\u003c/code\u003e, \u003ccode\u003essh_certificate_authority.destroy\u003c/code\u003e, and \u003ccode\u003essh_certificate_requirement.disable\u003c/code\u003e events.\u003c/li\u003e\n\u003cli\u003eRestrict administrative privileges for managing SSH CAs and certificate requirements to a minimal set of trusted, highly monitored owner accounts.\u003c/li\u003e\n\u003cli\u003eImplement automated alerting for any modification to SSH CA configurations or disabling of SSH certificate requirements.\u003c/li\u003e\n\u003cli\u003eIf unauthorized modifications are detected, immediately re-enable certificate requirements, restore the intended CA configuration, revoke any SSH keys added during the window of vulnerability, and rotate credentials for compromised accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T15:44:01Z","date_published":"2026-11-04T15:44:01Z","id":"https://feed.craftedsignal.io/briefs/2026-11-github-ssh-ca-modification/","summary":"Adversaries who compromise an organization or enterprise owner account may disable mandatory SSH certificate requirements or destroy certificate authorities to facilitate persistence and defense evasion by enabling the use of unmanaged SSH keys.","title":"GitHub: Unauthorized SSH Certificate Authority or Requirement Modification","url":"https://feed.craftedsignal.io/briefs/2026-11-github-ssh-ca-modification/"}],"language":"en","title":"CraftedSignal Threat Feed - GitHub (Organization and Enterprise)","version":"https://jsonfeed.org/version/1.1"}