CVE-2026-96890 GitHub CVE debrief

Who should care

Defenders responsible for GitHub Enterprise Server instances, especially those with GitHub Advanced Security and secret scanning enabled, should assess exposure and prioritize remediation.

Why it matters

The SSRF vulnerability in GitHub Enterprise Server allows attackers to issue requests to internal hosts, potentially leading to remote code execution. Defenders should prioritize verifying exposure, especially for instances with GitHub Advanced Security and secret scanning enabled, and ensure they are running fixed versions.

• Verify exposure of GitHub Enterprise Server instances
• Prioritize remediation for instances with GitHub Advanced Security and secret scanning enabled
• Monitor for suspicious activity on GitHub Enterprise Server instances
• Restrict secret scanning validator configurations

Technical summary

The SSRF vulnerability in GitHub Enterprise Server allowed requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The vulnerability affected GitHub Enterprise Server versions 3.20, 3.21, and 3.22 and was fixed in versions 3.20.9, 3.21.7, and 3.22.2. The secret scanning validator for GCP service account credentials trusted the token endpoint embedded in a committed credential and issued a request to it without restricting the destination. Defenders should prioritize verifying exposure of GitHub Enterprise Server instances, especially those with GitHub Advanced Security and secret scanning enabled, and ensure they are running fixed versions.

Defensive priority

Defenders should prioritize verifying exposure of GitHub Enterprise Server instances, especially those with GitHub Advanced Security and secret scanning enabled, and ensure they are running fixed versions 3.20.9, 3.21.7, or 3.22.2.

Recommended defensive actions

• Verify GitHub Enterprise Server instances for exposure, especially those with GitHub Advanced Security and secret scanning enabled
• Ensure instances are running fixed versions 3.20.9, 3.21.7, or 3.22.2
• Review and restrict secret scanning validator configurations
• Monitor for suspicious activity on GitHub Enterprise Server instances
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and source item provide details on the SSRF vulnerability in GitHub Enterprise Server, including affected versions (3.20, 3.21, and 3.22) and fixed versions (3.20.9, 3.21.7, and 3.22.2). Exploitation required an authenticated user with permission to push to a repository on an instance with GitHub Advanced Security and secret scanning validity checks enabled. Defenders should verify exposure, especially for instances with GitHub Advanced Security and secret scanning enabled, and ensure they are running fixed versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.