Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.7
CVE-2026-76851: GitHub Enterprise Server may allow attackers to run code
CVE-2026-76851 · published 2 months ago
Summary
GitHub Enterprise Server versions before the latest updates let a user who can add custom push‑time code trick the server into contacting its own internal services. This could let the attacker execute commands on the server and take control of the system. Install the latest GitHub Enterprise Server release (3.22 or later) to close the gap.
What to do
- Update github enterprise server to version 3.17.20.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| github | enterprise server |
<= 3.17.19 Fix: upgrade to 3.17.20
|
| github | enterprise_server |
< 3.17.20 >= 3.18.0, < 3.18.14 >= 3.19.0, < 3.19.11 >= 3.20.0, < 3.20.7 >= 3.21.0, < 3.21.5 cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:* |
Original advisory text
Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services
A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests to a privileged service, leading to elevated code execution. Exploitation required pre-receive hook networking to be enabled and either site administrator privileges or write access to a repository containing a configured pre-receive hook. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. This vulnerability was reported via the GitHub Bug Bounty program.
References
- https://docs.github.com/en/[email protected]/admin/release-notes#3.17.20 Release Notes Vendor Advisory
- https://docs.github.com/en/[email protected]/admin/release-notes#3.18.14 Release Notes Vendor Advisory
- https://docs.github.com/en/[email protected]/admin/release-notes#3.19.11 Release Notes Vendor Advisory
- https://docs.github.com/en/[email protected]/admin/release-notes#3.20.7 Release Notes Vendor Advisory
- https://docs.github.com/en/[email protected]/admin/release-notes#3.21.5 Release Notes Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
7.7
High
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published1 Sep 2026
Updated31 Oct 2026
First seen2 Sep 2026
Track software like this
Free during beta