SSRF in GitHub Enterprise Server
CVE-2026-18730
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster configuration and issued gateway-to-agent requests whose HMAC authenticated only a timestamp, not the request path or body. An attacker positioned to intercept the outbound request could capture this token and replay it against privileged management agent endpoints. High-availability deployments were not affected due to a topology restriction. This vulnerability affected GitHub Enterprise Server releases in the 3.17, 3.18, 3.19, 3.20, and 3.21 series and was fixed in versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6. This vulnerability was reported via the GitHub Bug Bounty program.
Vulnerability class: SSRF (Server-Side Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.003 (20.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 20th percentile — 20.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
Weakness classification (CWE)
References
- docs.github.com/en/enterprise-server@3.17/admin/release-notes (release-notes, Release Notes, Vendor Advisory)
- docs.github.com/en/enterprise-server@3.18/admin/release-notes (release-notes, Release Notes, Vendor Advisory)
- docs.github.com/en/enterprise-server@3.19/admin/release-notes (release-notes, Release Notes, Vendor Advisory)
- docs.github.com/en/enterprise-server@3.20/admin/release-notes (release-notes, Release Notes, Vendor Advisory)
- docs.github.com/en/enterprise-server@3.21/admin/release-notes (release-notes, Release Notes, Vendor Advisory)
- docs.github.com/en/enterprise-server@3.17/admin/release-notes (release-notes)
- docs.github.com/en/enterprise-server@3.18/admin/release-notes (release-notes)
- docs.github.com/en/enterprise-server@3.19/admin/release-notes (release-notes)
- docs.github.com/en/enterprise-server@3.20/admin/release-notes (release-notes)
- docs.github.com/en/enterprise-server@3.21/admin/release-notes (release-notes)
Frequently asked questions
- What is CVE-2026-18730?
- CVE-2026-18730 is a high-severity vulnerability in GitHub Enterprise Server, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.4/10. Published 2026-09-01.
- How severe is CVE-2026-18730?
- High severity. CVSS v3 base score is 7.4 out of 10.