CVE-2026-76851 GitHub CVE debrief

Who should care

GitHub Enterprise Server administrators and users with write access to repositories containing configured pre-receive hooks should assess exposure and prioritize patching. Affected operator, platform, vulnerability-management, and security-team impact should be considered when evaluating the risk of this vulnerability.

Why it matters

GitHub Enterprise Server administrators should prioritize patching to prevent potential code execution and elevation of privileges through this SSRF vulnerability. Exploitation requires specific configurations and access, but verifying patch deployment and pre-receive hook configurations is crucial.

• Potential remote code execution on GitHub Enterprise Server instances.
• Elevation of privileges through impersonation of internal services.
• Possible disruption of service through exploitation of pre-receive hooks.
• Verification of patch deployment and configuration of pre-receive hooks is necessary.

Technical summary

The vulnerability allowed malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests to a privileged service, leading to elevated code execution. Exploitation required pre-receive hook networking to be enabled and either site administrator privileges or write access to a repository containing a configured pre-receive hook. This issue affected all versions prior to 3.22 and was fixed in versions 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. The vulnerability was identified in GitHub Enterprise Server, allowing remote code execution on the instance.

Defensive priority

GitHub Enterprise Server administrators should prioritize patching to prevent potential code execution.

Recommended defensive actions

• Apply patches to GitHub Enterprise Server instances to prevent potential code execution.
• Review and update pre-receive hook configurations to ensure they do not introduce vulnerabilities.
• Monitor GitHub Enterprise Server instances for suspicious activity.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed versions. The vulnerability was reported via the GitHub Bug Bounty program. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify patch deployment and pre-receive hook configurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.