GitHub (Organization and Enterprise) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/github-organization-and-enterprise/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 15:44:01 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGitHub: Unauthorized SSH Certificate Authority or Requirement Modificationhttps://feed.craftedsignal.io/briefs/2026-11-github-ssh-ca-modification/Wed, 04 Nov 2026 15:44:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-github-ssh-ca-modification/Adversaries who compromise an organization or enterprise owner account may disable mandatory SSH certificate requirements or destroy certificate authorities to facilitate persistence and defense evasion by enabling the use of unmanaged SSH keys.GitHub organizations and enterprises can utilize SSH certificate authorities (CAs) to issue short-lived SSH certificates, mandating their use in place of personal SSH keys for Git access. This configuration centralizes access control and enforces time-bounded authentication. Unauthorized modifications to these settings, specifically the creation or destruction of a CA or the disabling of certificate requirements, significantly weaken access controls. Following an account takeover, an adversary may perform these actions to authenticate using unmanaged SSH keys, bypassing the organization's intended security posture.

Impact

Successful unauthorized modification of SSH certificate requirements allows an adversary to authenticate to organizational repositories using persistent, unmanaged SSH keys. This weakens Git access control, bypasses centralized and time-bounded authentication policies, and provides a mechanism for sustained persistence and defense evasion.

Recommendation

  • Audit GitHub audit logs for ssh_certificate_authority.create, ssh_certificate_authority.destroy, and ssh_certificate_requirement.disable events.
  • Restrict administrative privileges for managing SSH CAs and certificate requirements to a minimal set of trusted, highly monitored owner accounts.
  • Implement automated alerting for any modification to SSH CA configurations or disabling of SSH certificate requirements.
  • If unauthorized modifications are detected, immediately re-enable certificate requirements, restore the intended CA configuration, revoke any SSH keys added during the window of vulnerability, and rotate credentials for compromised accounts.
]]>highadvisorysaasgithubpersistencedefense-evasionaccess-control