Do Son 
TL;DR
GitHub released security updates addressing several GitHub Enterprise Server vulnerabilities. These critical flaws could permit remote code execution and unauthorized access to internal services. Currently, no active exploitation in the wild or public proof-of-concept exploit code has been confirmed.
- Total: 4 CVEs
- Severity: 1 Critical · 2 High · 1 Medium
- Actively exploited: None confirmed
- Highest severity: 9.3 (Critical · CVSSv4) — CVE-2026-77987
- Action: Apply the latest security updates now
Track every CVE that hits your stack the moment it's exploited.
Get free email alertsNotable CVEs
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-77987 | 9.3 | notebook viewer vulnerable to Server-side request forgery | 3.17.*, 3.17.21, 3.18.* (+9) | Not exploited |
| CVE-2026-18730 | 8.2 | Server-side request forgery in Manage API leaked a replayable gateway-agent bearer token | 3.17.*, 3.17.21, 3.18.* (+7) | Not exploited |
| CVE-2026-77912 | 7.4 | Stored cross-site scripting in allowed HTML attribute injection via the Markdown rendering pipeline | 3.17.*, 3.17.21, 3.18.* (+9) | Not exploited |
| CVE-2026-75101 | 6 | Authorization bypass in allowed reading of private pull request diffs and patches via repository name collision | 3.17.*, 3.17.21, 3.18.* (+7) | Not exploited |
Why It Matters
Tens of thousands of global enterprises rely on GitHub to manage proprietary source code. These GitHub Enterprise Server vulnerabilities expose sensitive internal network components to remote attackers. The most severe flaw enables attackers to extract instance secrets and execute commands directly on the appliance. Consequently, a successful attack could compromise entire corporate development pipelines. Fortunately, researchers responsibly reported these flaws through the official bug bounty program. Administrators must address these risks to maintain secure code repositories.
How The Attack Works
The critical vulnerability, tracked as CVE-2026-77987, targets the notebook viewer component. An attacker supplies a crafted URL specifying an explicit port to reach internal services. While response bodies remain hidden, response timing acts as an oracle. This timing discrepancy allows attackers to extract instance secrets and achieve remote code execution.
Another high-severity flaw, CVE-2026-18730, involves the Manage API endpoint. An unauthenticated attacker supplies a malicious cluster configuration to force crafted outbound requests. An attacker intercepting these callbacks can capture a replayable management bearer token. High-availability deployments avoid this flaw due to topology restrictions.
Additionally, CVE-2026-77912 permits cross-site scripting through Markdown content. The rendering pipeline rewrites quote characters within already-sanitized HTML without re-sanitizing the output. This lapse allows authenticated users to inject arbitrary HTML attributes into rendered pages.
Affected Versions
These vulnerabilities affect GitHub Enterprise Server versions prior to the latest security releases. The flaws impact the 3.17, 3.18, 3.19, 3.20, 3.21, and 3.22 series branches.
Patch Or Mitigation Steps
Organizations must install the latest security fixes immediately. Administrators should upgrade their instances to versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, 3.21.6, or 3.22.1. The updated software now rejects notebook viewer URLs containing explicit ports. Furthermore, the patches add necessary authorization validations for package uploads. You can download the updates directly from the GitHub Enterprise releases page to secure your deployment.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
