PT-2026-38594 · Github · Github Enterprise Server

R31N · Published 2026-05-07 · Updated 2026-05-10 · CVE-2026-8034

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21

Description A server-side request forgery (SSRF) issue exists in the notebook viewer. This occurs due to URL parser confusion between the validation layer and the HTTP request library, where the hostname validation uses a different parser than the request library. This allows a crafted URL to bypass validation and direct requests to unintended internal services. Exploitation requires network access to the instance.

Recommendations Update to version 3.16.18 Update to version 3.17.15 Update to version 3.18.9 Update to version 3.19.6 Update to version 3.20.2 Update to version 3.21 or later

Fix

SSRF

Weakness Enumeration

CWE-918

CWE-436

Related Identifiers

CVE-2026-8034

Affected Products

Github Enterprise Server

References · 10

• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8034 · Security Note
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.9 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.15 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18 · Vendor Advisory
• https://t.me/CVEtracker/53043 · Telegram Post
• https://twitter.com/CVEnew/status/2053559187871797292 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2052599355987689877 · Twitter Post
• https://twitter.com/UpwindMDR/status/2052628462809104477 · Twitter Post