PT-2026-43433 · Github · Github Enterprise Server

R31N · Published 2026-05-26 · Updated 2026-05-27 · CVE-2026-8606

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21.1

Description A Server-Side Request Forgery (SSRF) allows an attacker to force the server to send HTTP requests to internal services through the security advisories package lookup feature. By targeting an internal management service and analyzing response timing, an attacker can infer sensitive environment variables, such as private keys and signing secrets. This issue requires GitHub Packages to be enabled. On instances not operating in private mode, the flaw is exploitable without authentication; otherwise, it requires an authenticated user.

Recommendations Update to version 3.21.1 or later. Update to version 3.20.3. Update to version 3.19.7. Update to version 3.18.10. Update to version 3.17.16. Update to version 3.16.19. As a temporary mitigation, disable GitHub Packages to prevent exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-8606

Affected Products

Github Enterprise Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-8606 · Security Note
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.16 · Note
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.19 · Note
• https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.1 · Note
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.7 · Note
• https://t.me/cveNotify/164768 · Telegram Post
• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.3 · Note
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.10 · Note