CVE-2026-76851

Received Received - Intake

Server-Side Request Forgery in GitHub Enterprise Server

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc. (Products Only)

Description

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests to a privileged service, leading to elevated code execution. Exploitation required pre-receive hook networking to be enabled and either site administrator privileges or write access to a repository containing a configured pre-receive hook. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-76851

Affected Vendors & Products

Vendor	Product	Version / Range
github	enterprise_server	to 3.22 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in GitHub Enterprise Server that allows remote code execution. It occurs due to insufficient network isolation, letting malicious pre-receive hook code impersonate internal services and redirect requests to privileged services. Exploitation requires pre-receive hook networking to be enabled and either site admin privileges or write access to a repository with a configured pre-receive hook.

Detection Guidance

Detection requires checking GitHub Enterprise Server versions and pre-receive hook configurations. Verify if your version is below 3.17.20, 3.18.14, 3.19.11, 3.20.7, or 3.21.5. Inspect repository settings for enabled pre-receive hooks with network access.

Impact Analysis

An attacker could exploit this to execute arbitrary code on the GitHub Enterprise Server instance, potentially gaining control over the system. This could lead to unauthorized access, data breaches, or disruption of services if the instance is compromised.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected versions may face legal penalties, reputational damage, or loss of certification if exploited.

Mitigation Strategies

Update GitHub Enterprise Server to a fixed version (3.17.20, 3.18.14, 3.19.11, 3.20.7, or 3.21.5 or later). Disable pre-receive hook networking if not required. Restrict write access to repositories with pre-receive hooks.

Hi! I’m here to help you understand CVE-2026-76851. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70