PT-2026-34213 · Github · Github Enterprise Server

R31N · Published 2026-04-21 · Updated 2026-04-26 · CVE-2026-5921

Positive Technologies (AI Summary)

CVSS v4.0

9.5

Critical

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21

Description A server-side request forgery (SSRF) allows an attacker to extract sensitive environment variables from an instance via a timing side-channel attack against the notebook rendering service. When private mode is disabled, the notebook viewer follows HTTP redirects without revalidating the destination host, enabling unauthenticated SSRF to internal services. By chaining the instance's open redirect endpoint through an external redirect to reach internal services and using regex filter queries against an internal API to measure response time differences, an attacker can infer secret values character by character.

Recommendations Update to version 3.14.26 Update to version 3.15.21 Update to version 3.16.17 Update to version 3.17.14 Update to version 3.18.8 Update to version 3.19.5 Update to version 3.20.1 Enable private mode to prevent the notebook viewer from following redirects to internal services.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-5921

Affected Products

Github Enterprise Server

References · 11

• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.8 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.14 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.5 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.26 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.21 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5921 · Security Note
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.17 · Vendor Advisory
• https://twitter.com/integ_sec/status/2048375306419863935 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2046853473816215929 · Twitter Post
• https://twitter.com/CVEnew/status/2048481086393495904 · Twitter Post