A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the… (CVE-2026-18730)
Description
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster configuration and issued gateway-to-agent requests whose HMAC authenticated only a timestamp, not the request path or body. An attacker positioned to intercept the outbound request could capture this token and replay it against privileged management agent endpoints. High-availability deployments were not affected due to a topology restriction. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.19, 3.18.13, 3.19.10, 3.20.6, and 3.21.4. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS v3.1
Score 7.4high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-18730 is an SSRF vulnerability in GitHub Enterprise Server's Manage API that allowed unauthenticated attackers to send crafted outbound requests to attacker-controlled hosts. The vulnerability stemmed from an endpoint that accepted attacker-supplied cluster configurations and generated gateway-to-agent requests authenticated by an HMAC that only covered a timestamp, not the full request details. This flaw enabled attackers positioned to intercept outbound requests to capture and replay authentication tokens against privileged management agent endpoints. High-availability deployments were not vulnerable due to topology restrictions. The vulnerability affects all versions prior to 3.22 and was fixed in specific patch releases starting with 3.17.19.
Potential Impact
An unauthenticated attacker could exploit this SSRF vulnerability to cause the server to send requests to arbitrary hosts controlled by the attacker. By intercepting these outbound requests, the attacker could capture authentication tokens and replay them to access privileged management agent endpoints, potentially leading to unauthorized management actions. High-availability deployments are not affected. There are no known exploits in the wild reported.
Mitigation Recommendations
This vulnerability has been fixed in GitHub Enterprise Server versions 3.17.19, 3.18.13, 3.19.10, 3.20.6, and 3.21.4. Users should upgrade to one of these fixed versions or later to remediate the issue. No additional mitigation is indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-xh7g-7v3x-h73p
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-18730"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a984569acd9273b496acc98
Added to database: 09/02/2026, 15:48:57 UTC
Last enriched: 09/07/2026, 20:07:35 UTC
Last updated: 10/15/2026, 18:48:18 UTC
Views: 48
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.