Quick answers
- Is CVE-2026-110288 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-110288 being exploited in the wild.
- How severe is CVE-2026-110288?
- Informational severity, published 3 November 2026.
- Which products and versions are affected?
- GitHub Enterprise Server prior to 3.23.
- Is there a fix for CVE-2026-110288?
- Yes: fixed in GitHub Enterprise Server 3.19.14, 3.20.10, 3.21.8, 3.22.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-110288 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-110288?
- Check whether you run GitHub Enterprise Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: GitHub Enterprise Server 3.19.14, 3.20.10, 3.21.8, 3.22.3
Technical details
A CSRF vulnerability in the ChatOps integration removal endpoint of GitHub Enterprise Server's Management Console failed to validate CSRF tokens on GET requests. An unauthenticated attacker could induce an authenticated operator's browser to send a request that deletes stored Slack and Microsoft Teams ChatOps credentials. Exploitation required the operator to visit attacker-controlled content while authenticated; no code execution or data extraction occurred, only configuration deletion.
Affected products
- GitHub Enterprise Server prior to 3.23
Timeline
- 2026-11-03: disclosed