CVE-2026-96890
Received Received - Intake

Server-Side Request Forgery in GitHub Enterprise Server

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: GitHub, Inc. (Products Only)

Description
A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret scanning validator for GCP service account credentials trusted the token endpoint embedded in a committed credential and issued a request to it without restricting the destination. Exploitation required an authenticated user with permission to push to a repository on an instance with GitHub Advanced Security and secret scanning validity checks enabled, a non-default configuration. This vulnerability affected GitHub Enterprise Server 3.20, 3.21, and 3.22 and was fixed in versions 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported through the GitHub Bug Bounty program.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-96890
EUVD
EUVD-2026-93667

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
GitHub Enterprise Server 3.20.0
GitHub Enterprise Server 3.21.0
GitHub Enterprise Server 3.22.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in GitHub Enterprise Server. It allows a repository contributor to trick the system into making requests to internal hosts controlled by an attacker. This can be chained with other issues to execute remote code on the server.

Impact Analysis

If exploited, an attacker could gain unauthorized access to internal systems, steal sensitive data, or execute malicious code on the server. This requires an authenticated user with repository push permissions and specific non-default configurations enabled.

Mitigation Strategies

Immediately update GitHub Enterprise Server to versions 3.20.9, 3.21.7, or 3.22.2 or later to patch the SSRF vulnerability. Disable GitHub Advanced Security and secret scanning validity checks if not required, as exploitation requires these non-default configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96890. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart