This vulnerability in GitHub Enterprise Server (CVE-2026-5921) is a server-side request forgery (SSRF) flaw categorized under CWE-918. It arises when the notebook viewer, with private mode disabled, follows HTTP redirects without revalidating the destination host, allowing unauthenticated SSRF to internal services. An attacker can exploit this by chaining the instance's open redirect endpoint through an external redirect to internal APIs and use timing side-channel attacks to infer secret environment variables character by character. The vulnerability affects all versions before 3.21 and was addressed in multiple patch releases starting from 3.14.26 onward.

An attacker can extract sensitive environment variables from the GitHub Enterprise Server instance without authentication by exploiting SSRF combined with timing side-channel attacks. This can lead to disclosure of secrets that may compromise the confidentiality and integrity of the affected system. The vulnerability requires private mode to be disabled and the ability to leverage open redirect endpoints, limiting but not eliminating the risk. The CVSS 4.0 base score is 8.9, indicating high severity.

Fixes for this vulnerability are available in GitHub Enterprise Server versions 3.14.26, 3.15.21, 3.16.17, 3.17.14, 3.18.8, 3.19.5, and 3.20.1. Users should upgrade to one of these patched versions or later to remediate the issue. Since this is not a cloud service, administrators must apply these updates manually. Patch status is confirmed by the vendor advisory embedded in the description. No additional mitigation steps are specified or required beyond applying the official patches.