Patch Forecast
Amber warning
Patch this week.

CVE-2026-96890

Github Enterprise Server: server-side request forgery can lead to remote code execution

Risk score
61/100
CVSS
8.8 v3.1
Exploit chance (30 days)
0.5%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret scanning validator for…
Affected
Github Enterprise Server before 3.20.9, 3.21.7, 3.22.2
Fix
Upgrade Github Enterprise Server to 3.20.9, 3.21.7 or 3.22.2 (whichever matches your release line), or later.
Exploitation
No known exploitation

Story map

Story map: Github Enterprise ServerTHE FLAWSTHE FIXCVE-2026-96890Server-side request forgerycan lead to remote codeexecutionCVSS 8.8 · EPSS 0%CVE-2026-103620Missing authorisationCVSS 6.5 · EPSS 0%Upgrade Github Enterprise…3.20.9 · 3.21.7 · 3.22.2 · 3.18.16· 3.19.13or later on your release lineWho is exposedGithub Enterprise Serverbefore 3.20.9, 3.21.7, 3.22.2AMBER · PATCH THIS WEEKGithub EnterpriseServerA Server-Side Request Forgery(SSRF) vulnerability wasidentified in GitHub EnterpriseServer that allowed a repositorycontributor to cause theappliance to issue requests toattacker-controlled internal…Where it standsNo known exploitationCONNECTS TOSame weaknessServer-side request forgery (CWE-918)221 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Github Enterprise Server: Amber, patch this week. A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret scanning validator for…

The flaws

  • CVE-2026-96890: Server-side request forgery can lead to remote code execution (CVSS 8.8 · EPSS 0%)
  • CVE-2026-103620: Missing authorisation (CVSS 6.5 · EPSS 0%)

The fix

Upgrade Github Enterprise Server: 3.20.9 · 3.21.7 · 3.22.2 · 3.18.16 · 3.19.13 or later on your release line

Who is exposed: Github Enterprise Server before 3.20.9, 3.21.7, 3.22.2

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 8.8 high

References

Original description

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret scanning validator for GCP service account credentials trusted the token endpoint embedded in a committed credential and issued a request to it without restricting the destination. Exploitation required an authenticated user with permission to push to a repository on an instance with GitHub Advanced Security and secret scanning validity checks enabled, a non-default configuration. This vulnerability affected GitHub Enterprise Server 3.20, 3.21, and 3.22 and was fixed in versions 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported through the GitHub Bug Bounty program.

Last activity 6 Oct 2026. Patch Forecast updates every hour.