CVE-2026-18730

Received Received - Intake

SSRF in GitHub Enterprise Server via Manage API

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc. (Products Only)

Description

A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster configuration and issued gateway-to-agent requests whose HMAC authenticated only a timestamp, not the request path or body. An attacker positioned to intercept the outbound request could capture this token and replay it against privileged management agent endpoints. High-availability deployments were not affected due to a topology restriction. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.19, 3.18.13, 3.19.10, 3.20.6, and 3.21.4. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-18730

Affected Vendors & Products

Vendor	Product	Version / Range
github	enterprise_server	to 3.22 (exc)
github	enterprise_server	3.17.19
github	enterprise_server	3.18.13
github	enterprise_server	3.19.10
github	enterprise_server	3.20.6
github	enterprise_server	3.21.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a server-side request forgery (SSRF) vulnerability in GitHub Enterprise Server. An unauthenticated attacker could manipulate an endpoint to send crafted outbound requests to a host they control. The vulnerability involved an endpoint parsing attacker-supplied cluster configuration and issuing requests with HMAC tokens that only authenticated timestamps, not the request path or body. Attackers could capture these tokens and replay them against privileged management endpoints.

Detection Guidance

This vulnerability is specific to GitHub Enterprise Server versions prior to 3.17.19, 3.18.13, 3.19.10, 3.20.6, and 3.21.4. Check your server version with commands like 'github-enterprise --version' or inspect the admin panel for version details. Monitor outbound requests from the Manage API to unexpected hosts, especially those involving gateway-to-agent communication.

Impact Analysis

An attacker could gain unauthorized access to privileged management agent endpoints by intercepting and replaying tokens. This could allow them to perform unauthorized actions on the server, potentially leading to data breaches, unauthorized code execution, or further network compromise. High-availability deployments were not affected.

Compliance Impact

This SSRF vulnerability could allow unauthorized access to internal systems by intercepting and replaying authenticated requests. For GDPR, this may lead to unauthorized data exposure or processing, violating principles of data protection and user rights. For HIPAA, it could enable unauthorized access to protected health information, compromising confidentiality and integrity requirements.

Mitigation Strategies

Upgrade GitHub Enterprise Server to a patched version (3.17.19, 3.18.13, 3.19.10, 3.20.6, or 3.21.4 or later). If immediate upgrade is not possible, restrict network access to the Manage API endpoints and monitor for suspicious outbound requests. Ensure high-availability deployments are properly configured to avoid exposure.

Hi! I’m here to help you understand CVE-2026-18730. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70