CVE-2026-96890

Awaiting Analysis Awaiting Analysis - Queue

Server-Side Request Forgery in GitHub Enterprise Server

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: GitHub, Inc. (Products Only)

Description

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret scanning validator for GCP service account credentials trusted the token endpoint embedded in a committed credential and issued a request to it without restricting the destination. Exploitation required an authenticated user with permission to push to a repository on an instance with GitHub Advanced Security and secret scanning validity checks enabled, a non-default configuration. This vulnerability affected GitHub Enterprise Server 3.20, 3.21, and 3.22 and was fixed in versions 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported through the GitHub Bug Bounty program.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-96890

EUVD

EUVD-2026-93667

Affected Vendors & Products

Vendor	Product	Version / Range
github	enterprise_server	From 3.20.0 (inc) to 3.20.9 (exc)
github	enterprise_server	From 3.21.0 (inc) to 3.21.7 (exc)
github	enterprise_server	From 3.22.0 (inc) to 3.22.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in GitHub Enterprise Server. It allows a repository contributor to trick the system into making requests to internal hosts controlled by an attacker. This can be chained with other issues to execute remote code on the server.

Detection Guidance

Detection requires checking for GitHub Enterprise Server versions 3.20, 3.21, or 3.22 without the latest patches. Verify installed versions and compare against fixed releases 3.20.9, 3.21.7, or 3.22.2. Inspect repository contributors for unusual push activity to repositories with secret scanning enabled.

Impact Analysis

If exploited, an attacker could gain unauthorized access to internal systems, steal sensitive data, or execute malicious code on the server. This requires an authenticated user with repository push permissions and specific non-default configurations enabled.

Compliance Impact

This SSRF vulnerability could allow unauthorized access to internal systems, potentially exposing sensitive data. For GDPR, this may lead to violations of data protection principles if personal data is accessed or exfiltrated. For HIPAA, it could compromise protected health information if the affected system handles such data. Organizations using affected GitHub Enterprise Server versions may face compliance risks due to insufficient access controls.

Mitigation Strategies

Immediately update GitHub Enterprise Server to versions 3.20.9, 3.21.7, or 3.22.2 or later to patch the SSRF vulnerability. Disable GitHub Advanced Security and secret scanning validity checks if not required, as exploitation requires these non-default configurations.

Hi! I’m here to help you understand CVE-2026-96890. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70