Critical CVE-2026-77987 affects GitHub Enterprise Server, allowing attackers to exploit an ...

Affected software: Enterprise Server (3.17.0, 3.18.0, 3.19.0, 3.20.0, 3.21.0 (and more...))

Type: CWE-918: CWE-918 Server-Side Request Forgery (SSRF), CWE-208: CWE-208 Observable Timing Discrepancy

CVE/CVSS: CVE-2026-77987: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

GitHub Enterprise Server versions 3.17 through 3.22 are affected by a critical server-side request forgery (SSRF) vulnerability in the notebook viewer. CVE-2026-77987 allows an attacker to supply a notebook viewer URL containing an explicit port, enabling requests to be directed to internal services running on other ports of the same GitHub Enterprise Server appliance. GitHub's validation checked the URL scheme and host but failed to validate the port.

The vulnerability is rated Critical , with a CVSS v4.0 score of 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Exploitation requires network access to the GitHub Enterprise Server instance and does not require user interaction. When private mode is disabled, exploitation is unauthenticated; when private mode is enabled, an attacker requires any authenticated user account.

The impact to confidentiality, integrity, and availability is high .

There is no current public evidence identified of exploitation in the wild.

Delivery - The attacker sends a crafted request to the notebook viewer of a vulnerable GitHub Enterprise Server instance, supplying a URL that specifies an explicit port. The notebook viewer validates the URL scheme and host but fails to restrict the destination port, allowing the request to reach internal services exposed on other ports of the same appliance.

Internal Service Access / Secret Extraction - The vulnerable notebook viewer forwards the request to the attacker-selected internal service. Although the response body is not returned, differences in response timing provide an observable oracle. The attacker can use this timing side channel to determine information the targeted service and extract instance secrets character by character.

Execute / Post-Compromise - The attacker uses an extracted instance secret in a separate interaction with an internal service to obtain remote code execution on the GitHub Enterprise Server appliance. Successful exploitation can therefore progress from SSRF and timing-based information disclosure to arbitrary code execution and compromise of the underlying GitHub Enterprise Server instance.

The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority after thorough testing.

The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity and ensure a swift response in case of an intrusion. In case of an intrusion, you can report an incident via . While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.