This vulnerability in GitHub Enterprise Server (CVE-2026-8606) is a Server-Side Request Forgery (CWE-918) that leverages the security advisories package lookup feature to cause the server to issue HTTP requests to internal management services. By measuring response timing, an attacker can infer sensitive environment variables including signing secrets and private keys. The vulnerability affects all versions before 3.21.1 and requires GitHub Packages to be enabled. Exploitation is possible without authentication on instances not running in private mode; otherwise, any authenticated user can exploit it. The vulnerability was reported through the GitHub Bug Bounty program and fixed in multiple patch releases across affected versions.

Successful exploitation allows an attacker to perform SSRF attacks that can reveal sensitive environment variables such as signing secrets and private keys. This can lead to further compromise of the server or its environment. The vulnerability is rated high severity with a CVSS 4.0 score of 7. No known exploits in the wild have been reported.

Fixes for this vulnerability are available in GitHub Enterprise Server versions 3.20.3, 3.19.7, 3.18.10, 3.17.16, and 3.16.19. Users should upgrade affected instances to one of these versions or later to remediate the issue. Since this is not a cloud service, remediation depends on applying these official patches. Patch status is confirmed by the vendor advisory embedded in the description.