Executive brief
GitHub Enterprise Server is a self-hosted platform for software development and version control. A security flaw in the security advisories feature could allow an attacker to trick the server into communicating with internal management services. By measuring the time it takes for the server to respond, an attacker could potentially steal sensitive information such as private encryption keys and signing secrets, which could compromise the integrity of the entire platform.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the security advisories package lookup feature of GitHub Enterprise Server. The package URL endpoint failed to validate supplied package names, allowing an attacker to force the server to issue HTTP requests to internal management services. By utilizing a timing side-channel attack against these internal responses, an attacker could infer the values of sensitive environment variables, such as signing secrets and private keys. Exploitation requires GitHub Packages to be enabled. If the instance is not in private mode, the vulnerability is exploitable without authentication; otherwise, any authenticated user can exploit it. GitHub addressed the issue by removing the affected endpoint.
Affected products
- GitHub Enterprise Server < 3.21.1, 3.20.x < 3.20.3, 3.19.x < 3.19.7, 3.18.x < 3.18.10, 3.17.x < 3.17.16, 3.16.x < 3.16.19
Timeline
- 2026-05-26: patched: Fixed in versions 3.21.1, 3.20.3, 3.19.7, 3.18.10, 3.17.16, and 3.16.19
- 2026-05-27: advisory: NVD publication date
References
- https://docs.github.com/en/enterprise-server@3.16/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.17/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.18/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.19/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.20/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.21/admin/release-notes