Description
A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret scanning validator for GCP service account credentials trusted the token endpoint embedded in a committed credential and issued a request to it without restricting the destination. Exploitation required an authenticated user with permission to push to a repository on an instance with GitHub Advanced Security and secret scanning validity checks enabled, a non-default configuration. This vulnerability affected GitHub Enterprise Server 3.20, 3.21, and 3.22 and was fixed in versions 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported through the GitHub Bug Bounty program.
Published: 2026-10-06
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via SSRF
Action: Patch Immediately
AI Analysis

Impact

A Server‑Side Request Forgery flaw in GitHub Enterprise Server allows a repository contributor to cause the appliance to issue HTTP requests to attacker‑controlled internal hosts. The vulnerability was exposed when the secret‑scanning validator for Google Cloud Platform service account credentials trusted the token endpoint embedded in a committed credential and sent an unfiltered request to it. If an attacker can chain such a request into a broader exploit, the result is remote code execution on the appliance, as the SSRF injection effectively bypasses the server’s outbound traffic restrictions.

Affected Systems

GitHub Enterprise Server versions 3.20, 3.21, and 3.22 are affected. The vulnerability is fixed in versions 3.20.9, 3.21.7, and 3.22.2 respectively. Any instance running an unpatched release with the advanced security feature and secret scanning enabled is susceptible.

Risk and Exploitability

The CVSS score for this vulnerability is 8.7, indicating high severity. EPSS information is not available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated contributor who can push to a repository, plus a non‑default configuration where GitHub Advanced Security and secret scanning are enabled. Once executed, the SSRF can be chained to achieve full remote code execution on the host running GitHub Enterprise Server.

Generated by OpenCVE AI on October 6, 2026 at 23:04 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied fix by upgrading to GitHub Enterprise Server 3.20.9, 3.21.7, or 3.22.2 or a newer release.
  • If an immediate upgrade is not possible, disable the GCP service account credential validator in the secret scanning feature or restrict its outbound access to only approved external endpoints.
  • Review and tighten the configuration of GitHub Advanced Security, ensuring that only trusted URLs are allowed for secret‑scanning validation and that internal host access is blocked where feasible.

Generated by OpenCVE AI on October 6, 2026 at 23:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Wed, 07 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 04:15:00 +0000

Type Values Removed Values Added
First Time appeared Github
Github enterprise Server
Vendors & Products Github
Github enterprise Server

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret scanning validator for GCP service account credentials trusted the token endpoint embedded in a committed credential and issued a request to it without restricting the destination. Exploitation required an authenticated user with permission to push to a repository on an instance with GitHub Advanced Security and secret scanning validity checks enabled, a non-default configuration. This vulnerability affected GitHub Enterprise Server 3.20, 3.21, and 3.22 and was fixed in versions 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported through the GitHub Bug Bounty program.
Title Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts
Weaknesses CWE-918
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Github Enterprise Server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_P

Published:

Updated: 2026-10-07T16:32:36.236Z

Reserved: 2026-09-23T19:00:02.480Z

Link: CVE-2026-96890

cve-icon Vulnrichment

Updated: 2026-10-07T16:32:30.485Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:18:17.167

Modified: 2026-10-09T14:04:56.293

Link: CVE-2026-96890

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T04:00:09Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)