The vulnerability is a Server‑Side Request Forgery that allows the GitHub Enterprise Server to send HTTP requests to internal services through the security advisories package lookup feature. By sending crafted URLs, an attacker can force the server to contact internal endpoints and observe timing to infer sensitive configuration values such as signing secrets and private keys. The flaw permits the disclosure of confidential data originating from internal services, potentially enabling further attacks.

The issue affects all GitHub Enterprise Server releases before version 3.21.1. The CVE references the GitHub Enterprise Server product from GitHub. Patches were released in 3.20.3 through 3.16.19, covering all earlier releases. The affected configuration requires GitHub Packages enabled; instances not running in private mode are exploitable without authentication, while private mode instances allow any authenticated user to exploit the flaw.

The CVSS score is 7, indicating a high severity. EPSS data are not available, so the likelihood of automated exploitation cannot be quantified, but the flaw is publicly documented and was reported through the bug bounty program. It is not listed in CISA's KEV catalog. Exploitation requires network access to the GitHub Enterprise Server; the attacker can trigger internal requests by submitting a URL to the package lookup endpoint. In environments where GitHub Packages is enabled and the server is reachable, no authentication is needed for public instances, increasing the attack surface. In private‑mode instances, any authenticated user can exploit the SSRF, elevating the risk for internal services. Patch deployment or network isolation reduces risk.