{"id":"CVE-2026-96890","published":"2026-10-06T19:18:17.167","lastModified":"2026-10-09T14:04:56.293","description":"A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret scanning validator for GCP service account credentials trusted the token endpoint embedded in a committed credential and issued a request to it without restricting the destination. Exploitation required an authenticated user with permission to push to a repository on an instance with GitHub Advanced Security and secret scanning validity checks enabled, a non-default configuration. This vulnerability affected GitHub Enterprise Server 3.20, 3.21, and 3.22 and was fixed in versions 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported through the GitHub Bug Bounty program.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-918"],"vendors":["github"],"products":["enterprise server"],"references":[{"url":"https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.9","tags":["Release Notes","Vendor Advisory"]},{"url":"https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.7","tags":["Release Notes","Vendor Advisory"]},{"url":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.2","tags":["Release Notes","Vendor Advisory"]}],"exploitRefs":[{"url":"https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.9","tags":["Release Notes","Vendor Advisory"]},{"url":"https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.7","tags":["Release Notes","Vendor Advisory"]},{"url":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.2","tags":["Release Notes","Vendor Advisory"]}],"hasPoc":true,"ai":{"summary":"A Server-Side Request Forgery (SSRF) vulnerability in GitHub Enterprise Server allows authenticated repository contributors to make the server issue requests to internal hosts, potentially leading to remote code execution. This affects GCP service account credential validation and requires specific configuration with Advanced Security enabled.","exploitability":"Exploitation requires an authenticated user with push permissions on a repository with secret scanning enabled, making it moderately difficult but achievable in configured environments.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the GitHub Enterprise Server appliance, potentially compromising all repositories and data hosted on that instance.","remediation":"Upgrade to GitHub Enterprise Server versions 3.20.9, 3.21.7, or 3.22.2 to remediate this SSRF vulnerability.","detection":"Monitor for unusual outbound HTTP requests from the GitHub Enterprise Server appliance to internal IP addresses or domains, particularly during secret scanning validation processes.","tags":["ssrf","github","enterprise","gcp","secret-scanning"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:50:18.911Z"}}