CVE-2026-76851: CWE-918 Server-Side Request Forgery (SSRF) in GitHub Enterprise Server

CVE-2026-76851 is a high-severity SSRF vulnerability (CWE-918) in GitHub Enterprise Server that permits remote code execution by abusing insufficient network isolation. Malicious pre-receive hook code can impersonate internal services and redirect trusted internal requests to privileged services, leading to elevated code execution privileges. Successful exploitation requires that pre-receive hook networking is enabled and that the attacker has site administrator privileges or write access to a repository with a configured pre-receive hook. The vulnerability affects all versions prior to 3.22 and was addressed by GitHub in versions 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. The issue was reported through the GitHub Bug Bounty program. The CVSS 4.0 base score is 7.7, indicating high severity.

An attacker with site administrator privileges or write access to a repository with a configured pre-receive hook can exploit this SSRF vulnerability to achieve remote code execution on the GitHub Enterprise Server instance. This can lead to elevated privileges and potentially full control over the affected server. The vulnerability leverages insufficient network isolation to redirect internal trusted requests to privileged services.

This vulnerability has been fixed in GitHub Enterprise Server versions 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. Users should upgrade to one of these fixed versions or later to remediate the issue. Ensure that pre-receive hook networking is carefully managed and restrict write access to repositories with configured pre-receive hooks to trusted users only.