CVE-2026-77987 – GitHub Enterprise Server
“One unchecked port turns a notebook preview into a skeleton key for the entire appliance.”
GitHub has fixed a server-side request forgery flaw in the notebook viewer of GitHub Enterprise Server. CVE-2026-77987 has a CVSS score of 9.3, Critical severity. The viewer checked the scheme and host of a user-supplied URL but not the port. This let attackers send requests to internal services on other ports of the same appliance. Response timing then exposed instance secrets one character at a time. An attacker could use a stolen secret to run code remotely on the appliance.
Attackers need only network access when private mode is off. With private mode on, any signed-in user can exploit the flaw. Versions 3.17 through 3.22 are affected. The fix ships in 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21.
Key Details
- Affected Product
- Github Enterprise Server
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-208