CVE-2026-77987

Received Received - Intake

SSRF in GitHub Enterprise Server Notebook Viewer

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc. (Products Only)

Description

A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other ports of the same appliance. Response bodies were not returned to the requester, but response timing acted as an oracle that allowed instance secrets to be extracted character by character. An extracted secret could then be used in a separate interaction with an internal service to obtain remote code execution on the appliance. Exploitation required network access to the instance and was unauthenticated when private mode was disabled, or required any authenticated user when private mode was enabled. This vulnerability affected GitHub Enterprise Server versions 3.17 through 3.22 and was fixed in versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. This vulnerability was reported through the GitHub Bug Bounty program.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-77987

Affected Vendors & Products

Vendor	Product	Version / Range
github	enterprise_server	From 3.17 (inc) to 3.22 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-208	Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a server-side request forgery (SSRF) vulnerability in GitHub Enterprise Server's notebook viewer. It allows attackers to send crafted requests to internal services on the same appliance by exploiting unvalidated ports in user-supplied URLs. The attacker can extract secrets character by character through response timing differences, then use those secrets to achieve remote code execution on the appliance.

Detection Guidance

This vulnerability requires manual testing as it involves SSRF and timing-based secret extraction. Check GitHub Enterprise Server versions 3.17 through 3.22 for exposure. Test by attempting to access internal services via the notebook viewer URL parameter, monitoring response times for anomalies that indicate secret extraction.

Impact Analysis

An attacker could gain unauthorized access to internal services, steal sensitive data like secrets or credentials, and potentially execute arbitrary code on the server. This could lead to full compromise of the GitHub Enterprise Server instance, data breaches, or further lateral movement within the network.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to potential exposure of personal or protected health information, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update GitHub Enterprise Server to a fixed version (3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, or 3.17.21) to address the SSRF vulnerability.

Hi! I’m here to help you understand CVE-2026-77987. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70