Executive brief
GitHub Enterprise Server is a self-hosted platform for software development and version control. A security vulnerability was found in its notebook viewer component that could allow an attacker to trick the server into making unauthorized requests to internal systems. This could lead to the exposure of sensitive internal data or unauthorized access to services that are not intended to be reachable from the outside.
Technical details
A server-side request forgery (SSRF) vulnerability exists in the GitHub Enterprise Server notebook viewer due to URL parser confusion. The hostname validation layer and the underlying HTTP request library utilized different parsing logic, allowing a specially crafted URL to bypass security checks while being routed to an unintended internal host. An attacker with network access to the GHES instance (specifically when private mode is disabled) could exploit this to reach internal services. The fix involves aligning the URL parsing logic across both layers and implementing stricter validation for URL schemes, ports, and user information.
Affected products
- GitHub Enterprise Server < 3.21, fixed in 3.16.18, 3.17.15, 3.18.9, 3.19.6, 3.20.2
Timeline
- 2026-05-07: disclosed
- 2026-05-07: patched: Fixed in versions 3.16.18, 3.17.15, 3.18.9, 3.19.6, and 3.20.2
References
- https://docs.github.com/en/enterprise-server@3.16/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.17/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.18/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.19/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.20/admin/release-notes