CVE-2026-96890: CWE-918 Server-Side Request Forgery (SSRF) in GitHub Enterprise Server

CVE-2026-96890 is a high-severity SSRF vulnerability in GitHub Enterprise Server's secret scanning validator for GCP service account credentials. The validator trusted the token endpoint URL embedded in committed credentials and issued HTTP requests to it without destination restrictions. An authenticated user with push permissions on a repository in an instance configured with GitHub Advanced Security and secret scanning validity checks enabled could exploit this to cause the server to send requests to attacker-controlled internal hosts. This SSRF could be chained to achieve remote code execution on the appliance. The vulnerability affects versions >=3.20.0 <3.20.9, >=3.21.0 <3.21.7, and >=3.22.0 <3.22.2 and was fixed in 3.20.9, 3.21.7, and 3.22.2. The issue was reported via the GitHub Bug Bounty program.

An attacker with authenticated push access to a repository on a GitHub Enterprise Server instance configured with GitHub Advanced Security and secret scanning validity checks enabled could exploit this SSRF vulnerability to make the server issue requests to internal hosts controlled by the attacker. This could be chained to achieve remote code execution on the appliance, potentially compromising the server and its data. The vulnerability requires non-default configuration and authenticated access, limiting the attack surface.

A fix is available and has been released in GitHub Enterprise Server versions 3.20.9, 3.21.7, and 3.22.2. Administrators should upgrade affected instances to these or later versions to remediate the vulnerability. Since this is a server product, the vendor does not manage remediation for cloud services. No additional mitigation steps are indicated beyond applying the official patches.