Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery

CVSS 4.0 9.3 CRITICALCheck source for fixed versionsKEV status unknown

cve-program · CVE-2026-77987

Published

A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other ports of the same appliance. Response bodies were not returned to the requester, but response timing acted as an oracle that allowed instance secrets to be extracted character by character. An extracted secret could then be used in a separate interaction with an internal service to obtain remote code execution on the appliance. Exploitation required network access to the instance and was unauthenticated when private mode was disabled, or required any authenticated user when private mode was enabled. This vulnerability affected GitHub Enterprise Server versions 3.17 through 3.22 and was fixed in versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. This vulnerability was reported through the GitHub Bug Bounty program.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-77987

Published

Enterprise Server

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "GitHub",
                    "product": "Enterprise Server",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "3.17.0",
                            "lessThan": "3.17.*",
                            "changes": [
                                {
                                    "at": "3.17.21",
                                    "status": "unaffected"
                                }
                            ],
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "3.18.0",
                            "lessThan": "3.18.*",
                            "changes": [
                                {
                                    "at": "3.18.15",
                                    "status": "unaffected"
                                }
                            ],
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "3.19.0",
                            "lessThan": "3.19.*",
                            "changes": [
                                {
                                    "at": "3.19.12",
                                    "status": "unaffected"
                                }
                            ],
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "3.20.0",
                            "lessThan": "3.20.*",
                            "changes": [
                                {
                                    "at": "3.20.8",
                                    "status": "unaffected"
                                }
                            ],
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "3.21.0",
                            "lessThan": "3.21.*",
                            "changes": [
                                {
                                    "at": "3.21.6",
                                    "status": "unaffected"
                                }
                            ],
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "3.22.0",
                            "lessThan": "3.22.*",
                            "changes": [
                                {
                                    "at": "3.22.1",
                                    "status": "unaffected"
                                }
                            ],
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unknown"
                }

Original source record · Cite this exact observation · Complete original publisher JSON

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 12 Nov 18:36 UTC · 273 of 275 readable · 271 fully read · documentation 469/469 current