The vulnerability CVE-2026-8034 in GitHub Enterprise Server is a server-side request forgery (SSRF) issue caused by inconsistent URL parsing between the hostname validation layer and the HTTP request library within the notebook viewer component. This inconsistency allows an attacker with network access to the GitHub Enterprise Server to craft URLs that pass validation but redirect requests to internal services, potentially exposing sensitive internal resources. The flaw affects versions prior to 3.21 and was addressed in several patch releases starting from 3.16.18 through 3.20.2. The vulnerability was reported through the GitHub Bug Bounty program and carries a CVSS 4.0 score of 7.9, indicating high severity.

Successful exploitation could allow an attacker with network access to the GitHub Enterprise Server instance to make unauthorized requests to internal services that are otherwise inaccessible, potentially leading to information disclosure or further internal network attacks. The vulnerability does not require user interaction or privileges and can be triggered remotely over the network. There are no reports of known exploits in the wild at this time.

This vulnerability has been fixed in GitHub Enterprise Server versions 3.16.18, 3.17.15, 3.18.9, 3.19.6, and 3.20.2. Users should upgrade affected GitHub Enterprise Server instances to one of these patched versions or later to remediate the issue. Since this is an on-premises product, the vendor does not manage patching directly. Patch status is confirmed by the vendor advisory embedded in the description.