Riskcovery

CVE-2026-8606

Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint

State
Published
Severity
7.0 High
Published
May 26, 2026
Updated
May 27, 2026
Reserved
May 14, 2026

Read the record on cve.org

Description

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP requests to internal services via the security advisories package lookup feature. By directing requests to an internal management service and measuring response timing, an attacker could infer the values of sensitive environment variables, including signing secrets and private keys. Exploitation required GitHub Packages to be enabled; on instances not running in private mode the vulnerability was exploitable without authentication, otherwise any authenticated user could exploit it. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21.1 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, 3.17.16, and 3.16.19. This vulnerability was reported via the GitHub Bug Bounty program.

Scores

CVSSScoreVectorSource
4.07.0 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:NGitHub_P

Weaknesses

  • CWE-918 Server-Side request forgery (SSRF)

Affected Products

ProductVersions
Enterprise ServerGitHub
  • 3.21.0 to before 3.21.1Affectedfrom 3.21.1Not affected
  • 3.20.0 through 3.20.2Affectedfrom 3.20.3Not affected
  • 3.19.0 through 3.19.6Affectedfrom 3.19.7Not affected
  • 3.18.0 through 3.18.9Affectedfrom 3.18.10Not affected
  • 3.17.0 through 3.17.15Affectedfrom 3.17.16Not affected
  • 3.16.0 through 3.16.18Affectedfrom 3.16.19Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.