A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. (CVE-2026-76851)

CVE-2026-76851 is an SSRF vulnerability in GitHub Enterprise Server that allows remote code execution by abusing insufficient network isolation. Malicious pre-receive hook code can impersonate internal services and redirect trusted internal requests to privileged services, leading to elevated code execution privileges. Exploitation requires pre-receive hook networking enabled and either site admin privileges or write access to a repository with a pre-receive hook. The issue affects all versions before 3.22 and was fixed in versions 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. The vulnerability was responsibly disclosed via the GitHub Bug Bounty program.

Successful exploitation allows an attacker with specific privileges to execute arbitrary code remotely on the GitHub Enterprise Server instance. This can lead to full compromise of the instance due to elevated code execution capabilities. The vulnerability requires certain conditions (pre-receive hook networking enabled and appropriate privileges) to be met, limiting exposure to authorized users or contributors with write access.

This vulnerability has been fixed in GitHub Enterprise Server versions 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. Users should upgrade to one of these fixed versions or later. Since this is not a cloud service, remediation depends on applying these official patches. No additional mitigation is required if the system is updated to a fixed version.