CVE-2026-18730

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-18730
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster configuration and issued gateway-to-agent requests whose HMAC authenticated only a timestamp, not the request path or body. An attacker positioned to intercept the outbound request could capture this token and replay it against privileged management agent endpoints. High-availability deployments were not affected due to a topology restriction. This vulnerability affected GitHub Enterprise Server releases in the 3.17, 3.18, 3.19, 3.20, and 3.21 series and was fixed in versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6. This vulnerability was reported via the GitHub Bug Bounty program.

7.4 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.21
https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.15
https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.12
https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.8
https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.6
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
History

22 Sep 2026, 21:17

Type Values Removed Values Added
References
  • {'url': 'https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.19', 'tags': ['Release Notes', 'Vendor Advisory'], 'source': 'product-cna@github.com'}
  • {'url': 'https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.13', 'tags': ['Release Notes', 'Vendor Advisory'], 'source': 'product-cna@github.com'}
  • {'url': 'https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.10', 'tags': ['Release Notes', 'Vendor Advisory'], 'source': 'product-cna@github.com'}
  • {'url': 'https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.6', 'tags': ['Release Notes', 'Vendor Advisory'], 'source': 'product-cna@github.com'}
  • {'url': 'https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.4', 'tags': ['Release Notes', 'Vendor Advisory'], 'source': 'product-cna@github.com'}
  • () https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.21 -
  • () https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.15 -
  • () https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.12 -
  • () https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.8 -
  • () https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.6 -
Summary (en) A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster configuration and issued gateway-to-agent requests whose HMAC authenticated only a timestamp, not the request path or body. An attacker positioned to intercept the outbound request could capture this token and replay it against privileged management agent endpoints. High-availability deployments were not affected due to a topology restriction. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.19, 3.18.13, 3.19.10, 3.20.6, and 3.21.4. This vulnerability was reported via the GitHub Bug Bounty program. (en) A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster configuration and issued gateway-to-agent requests whose HMAC authenticated only a timestamp, not the request path or body. An attacker positioned to intercept the outbound request could capture this token and replay it against privileged management agent endpoints. High-availability deployments were not affected due to a topology restriction. This vulnerability affected GitHub Enterprise Server releases in the 3.17, 3.18, 3.19, 3.20, and 3.21 series and was fixed in versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6. This vulnerability was reported via the GitHub Bug Bounty program.
Information

Published : 2026-09-01 22:17

Updated : 2026-09-22 21:17

NVD link : CVE-2026-18730

Mitre link : CVE-2026-18730

CVE.ORG link : CVE-2026-18730

JSON object : View

Products Affected

github

  • enterprise_server
CWE
CWE-918

Server-Side Request Forgery (SSRF)