GitHub SSH Private Key Exposure
GitHub · Published 2023-03-24
The usual suspects
Click any phrase to see how often it appears across disclosures
At approximately 05:00 UTC on March 24, out of an abundance of caution, we replaced our RSA SSH host key used to secure Git operations for GitHub.com. We did this to protect our users from any chance of an adversary impersonating GitHub or eavesdropping on their Git operations over SSH. This key does not grant access to GitHub’s infrastructure or customer data. This change only impacts Git operations over SSH using RSA. Web traffic to GitHub.com and HTTPS Git operations are not affected.
Only GitHub.com’s RSA SSH key was replaced. No change is required for ECDSA or Ed25519 users. Our keys are documented here.
What happened and what actions have we taken?
This week, we discovered that GitHub.com’s RSA SSH private key was briefly exposed in a public GitHub repository. We immediately acted to contain the exposure and began investigating to understand the root cause and impact. We have now completed the key replacement, and users will see the change propagate over the next thirty minutes. Some users may have noticed that the new key was briefly present beginning around 02:30 UTC during preparations for this change.
Please note that this issue was not the result of a compromise of any GitHub systems or customer information. Instead, the exposure was the result of what we believe to be an inadvertent publishing of private information. We have no reason to believe that the exposed key was abused and took this action out of an abundance of caution.
What you can do
If you are using our ECDSA or Ed25519 keys, you will not notice any change and no action is needed.
If you see the following message when connecting to GitHub.com via SSH, then read onward.
If you see the above message, you’ll need to remove the old key by running this command:
Or manually updating your ~/.ssh/known_hosts file to remove the old entry.
Then, you can manually add the following line to add the new RSA SSH public key entry to your ~/.ssh/known_hosts file:
Or automatically update GitHub.com’s RSA SSH key in your ~/.ssh/known_hosts, by running the following in your terminal:
You can verify that your hosts are connecting via our new RSA SSH key by confirming that you see the following fingerprint:
GitHub Actions users may see failed workflow runs if they are using actions/checkout with the ssh-key option. We are updating the actions/checkout action in all our supported tags, including @v2, @v3, and @main. If you pin the action to a commit SHA and use the ssh-key option, you’ll need to update your workflow. You can read more about this process in our official documentation for Actions security hardening.
For more information, please visit our official documentation on GitHub’s SSH public key fingerprints.
Written by
Mike Hanley is the Chief Security Officer and SVP of Engineering at GitHub. Prior to GitHub, Mike was the Vice President of Security at Duo Security, where he built and led the security research, development, and operations functions. After Duo’s acquisition by Cisco for $2.35 billion in 2018, Mike led the transformation of Cisco’s cloud security framework and later served as CISO for the company. Mike also spent several years at CERT/CC as a Senior Member of the Technical Staff and security researcher focused on applied R&D programs for the US Department of Defense and the Intelligence Community.
When he’s not talking about security at GitHub, Mike can be found enjoying Ann Arbor, MI with his wife and eight kids.
Related posts
Pick your agent: Use Claude and Codex on Agent HQ
Claude by Anthropic and OpenAI Codex are now available in public preview on GitHub and VS Code with a Copilot Pro+ or Copilot Enterprise subscription. Here’s what you need to know and how to get started today.
Explore more from GitHub
Security
Secure platform, secure data. Everything you need to make security your #1.
Learn more
Join GitHub Galaxy
Register now for our global enterprise event on March 28–31.
Register now
GitHub Advanced Security
Secure your code without disrupting innovation.
Learn more
Enterprise content
Executive insights, curated just for you
Get started