CVE-2026-4821 - Vulnerability Details

- Proxy configuration command injection vulnerability found in GitHub Enterprise Server Management Console configuration API

Description

An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Management Console administrator to execute arbitrary OS commands via shell metacharacter injection in proxy configuration fields such as http_proxy. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and administrator privileges to the Management Console. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.

Published: 2026-04-21

Score: 8.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An improper neutralization of special elements vulnerability allows an authenticated Management Console administrator to inject shell metacharacters into proxy configuration fields, such as the http_proxy setting, and execute arbitrary operating‑system commands. This results in full control of the server, compromising confidentiality, integrity, and availability of the entire GitHub Enterprise Server instance.

Affected Systems

GitHub Enterprise Server versions prior to 3.21 are affected. The issue was addressed in releases 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21 and 3.14.26, and the vulnerability is present in all earlier releases.

Risk and Exploitability

The CVSS score of 8.1 reflects a high‑severity flaw. EPSS data is unavailable, but the vulnerability is not listed in CISA's KEV catalog, indicating no known widespread exploitation yet. Successful exploitation requires authenticated, privileged access to the GitHub Enterprise Server Management Console, meaning the attack surface is limited to administrators or compromised admin credentials. Even so, the impact of a successful attack is critical, providing full remote code execution on the server.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

GitHub

Enterprise Server

affected

Version	Status	Constraints
`3.20.0`	affected	< 3.20.1
`3.19.0`	affected	≤ 3.19.4
`3.18.0`	affected	≤ 3.18.7
`3.17.0`	affected	≤ 3.17.13
`3.16.0`	affected	≤ 3.16.16
`3.15.0`	affected	≤ 3.15.20
`3.14.0`	affected	≤ 3.14.25

No data.

Vendor Product Confidence Versions

Github

Enterprise Server

100%

Version	Status	Scheme	Platform
`[3.20.0,3.20.1)`	affected	semver	—
`[3.19.0,3.19.4]`	affected	semver	—
`[3.18.0,3.18.7]`	affected	semver	—
`[3.17.0,3.17.13]`	affected	semver	—
`[3.16.0,3.16.16]`	affected	semver	—
`[3.15.0,3.15.20]`	affected	semver	—
`[3.14.0,3.14.25]`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest patch by upgrading to GitHub Enterprise Server 3.20.1 or newer, ensuring all earlier vulnerable releases are removed.
Validate proxy configuration values to accept only well‑formed URLs and reject any shell metacharacters.
Restrict Management Console administrator privileges to a minimal trusted group and regularly monitor for unauthorized configuration changes.

Generated by OpenCVE AI on April 22, 2026 at 06:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Local

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact High

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00014.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.24
https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.21
https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.17
https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.14
https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.8
https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.5
https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1

History

Wed, 22 Apr 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 22 Apr 2026 04:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Github Github enterprise Server
Vendors & Products		Github Github enterprise Server

Wed, 22 Apr 2026 00:00:00 +0000

Type	Values Removed	Values Added
Description		An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Management Console administrator to execute arbitrary OS commands via shell metacharacter injection in proxy configuration fields such as http_proxy. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and administrator privileges to the Management Console. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.
Title		Proxy configuration command injection vulnerability found in GitHub Enterprise Server Management Console configuration API
Weaknesses		CWE-78
References		https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.24 https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.21 https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.17 https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.14 https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.8 https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.5 https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1
Metrics		cvssV4_0 `{'score': 8.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N'}`

Subscriptions

Github Enterprise Server

MITRE

Status: PUBLISHED

Assigner: GitHub_P

Published: 2026-04-21T22:12:26.772Z

Updated: 2026-04-22T13:17:26.288Z

Reserved: 2026-03-25T13:55:26.048Z

Link: CVE-2026-4821

Vulnrichment

Updated: 2026-04-22T13:17:21.381Z

NVD

Status : Awaiting Analysis

Published: 2026-04-21T23:16:22.037

Modified: 2026-04-22T21:23:52.620

Link: CVE-2026-4821

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-22T06:30:10Z

Weaknesses

CWE-78

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact High

Subsequent System Availability Impact None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object