PT-2026-20495 · Github · Github Enterprise Server

R31N · Published 2026-02-18 · Updated 2026-02-20 · CVE-2026-0573

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.19 GitHub Enterprise Server versions 3.19.2 GitHub Enterprise Server versions 3.18.4 GitHub Enterprise Server versions 3.17.10 GitHub Enterprise Server versions 3.16.13 GitHub Enterprise Server versions 3.15.17 GitHub Enterprise Server versions 3.14.22

Description An URL redirection issue exists in GitHub Enterprise Server. This flaw allows an attacker to control redirects, potentially exposing sensitive authorization tokens. Specifically, the repository pages API improperly handles HTTP redirects when retrieving artifact URLs, carrying over the authorization header which includes a JWT (JSON Web Token). An authenticated user could redirect these requests to a domain controlled by an attacker, leading to the theft of the Actions.ManageOrgs JWT. This stolen token could then be used for potential remote code execution. Exploitation requires access to the target GitHub Enterprise Server and the ability to exploit a redirect to an attacker-controlled domain.

Recommendations Upgrade to GitHub Enterprise Server version 3.19.2 or later. Upgrade to GitHub Enterprise Server version 3.18.4 or later. Upgrade to GitHub Enterprise Server version 3.17.10 or later. Upgrade to GitHub Enterprise Server version 3.16.13 or later. Upgrade to GitHub Enterprise Server version 3.15.17 or later. Upgrade to GitHub Enterprise Server version 3.14.22 or later.

Fix

RCE

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-0573

Affected Products

Github Enterprise Server

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-0573 · Security Note
• https://osv.dev/vulnerability/CVE-2026-0573 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.13 · Note
• https://t.me/cveNotify/152533 · Telegram Post
• https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.17 · Note
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.2 · Note
• https://twitter.com/TheHackerWire/status/2024647731185435047 · Twitter Post
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.10 · Note
• https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.22 · Note
• https://twitter.com/CVEnew/status/2024233236377854025 · Twitter Post
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.4 · Note