Executive brief
GitHub Enterprise Server's Manage API contains a server-side request forgery vulnerability that allows unauthenticated attackers to send crafted requests to arbitrary hosts and replay authentication tokens to access privileged management endpoints. An attacker positioned to intercept network traffic could use captured tokens to gain unauthorized access to sensitive management operations on the server.
Technical details
A server-side request forgery (SSRF) vulnerability exists in GitHub Enterprise Server's Manage API where an unauthenticated endpoint parses attacker-supplied cluster configuration and issues gateway-to-agent requests. The HMAC authentication mechanism authenticates only a timestamp, not the request path or body, allowing attackers to forge or replay tokens. The attack requires network positioning to intercept outbound requests, but no prior authentication is required to trigger the initial SSRF. An attacker can replay captured tokens against privileged management agent endpoints to execute unauthorized operations. The vulnerability was fixed in versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6; high-availability deployments were not affected due to topology restrictions.
Affected products
- GitHub Enterprise Server 3.17 (before 3.17.21), 3.18 (before 3.18.15), 3.19 (before 3.19.12), 3.20 (before 3.20.8), 3.21 (before 3.21.6)
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Patches released for versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6