CVE-2026-17556 GitHub CVE debrief

Who should care

Organizations using GitHub Enterprise Server, especially those with publicly accessible instances, should prioritize patching to prevent potential arbitrary file deletion. This includes reviewing and updating inventory of GitHub Enterprise Server instances to ensure they are running a patched version and monitoring instances for suspicious activity. Security teams and vulnerability management teams should also be aware of the potential impact and take necessary precautions. Additionally, operators and administrators of GitHub Enterprise Server instances should be aware of the vulnerability and take steps to mitigate it. This may involve reviewing system logs and monitoring for suspicious activity. Furthermore, organizations should consider implementing compensating controls, such as restricting access to sensitive areas of the instance, until a patch can be applied. It's also important for organizations to have an incident response plan in place in case of a potential exploit. By prioritizing patching and taking proactive steps, organizations can reduce the risk of arbitrary file deletion and protect their instances from potential exploitation. GitHub Enterprise Server instances that are not publicly accessible may still be vulnerable, so all instances should be reviewed and patched as necessary. The vulnerability's impact on an organization's specific instance will depend on its configuration and exposure. Therefore, a thorough review of the instance and its security controls is necessary to fully understand the potential impact and to determine the appropriate course of action. This should be done in conjunction with the vendor's guidance and support. The goal is to ensure the security and integrity of the instance and its data. By taking these steps, organizations can help prevent potential exploits and protect their instances from arbitrary file deletion. This vulnerability highlights the importance of keeping software up-to-date and having robust security controls in place. By prioritizing patching and security, organizations can reduce the risk of exploitation and protect their assets. In addition to patching, organizations should also consider monitoring,

Technical summary

A path traversal vulnerability was identified in GitHub Enterprise Server, allowing an unauthenticated attacker to delete arbitrary files and directories. The vulnerability was caused by the use of the X-GitHub-Request-Id request header without sanitization as a filesystem path segment. Exploitation required only network reachability to the instance and no authentication. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.4, 3.20.6, 3.19.10, 3.18.13 and 3.17.19.

Defensive priority

Organizations using GitHub Enterprise Server should prioritize patching to prevent potential arbitrary file deletion.

Recommended defensive actions

• Apply patches to GitHub Enterprise Server instances to prevent arbitrary file deletion.
• Review and update inventory of GitHub Enterprise Server instances to ensure they are running a patched version.
• Monitor GitHub Enterprise Server instances for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was reported via the GitHub Bug Bounty program. Affected versions of GitHub Enterprise Server include all versions prior to 3.22. Fixed versions include 3.21.4, 3.20.6, 3.19.10, 3.18.13, and 3.17.19. The CVE record was published on 2026-08-05T20:17:06.047Z and has not been modified since then. Organizations should verify their instances and apply patches as needed.

Official resources