CVE-2026-0573

An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens. The repository_pages API insecurely followed HTTP redirects when fetching artifact URLs, preserving the authorization header containing a privileged JWT. An authenticated user could redirect these requests to an attacker-controlled domain, exfiltrate the Actions.ManageOrgs JWT, and leverage it for potential remote code execution. Attackers would require access to the target GitHub Enterprise Server instance and the ability to exploit a legacy redirect to an attacker-controlled domain. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.19 and was fixed in versions 3.19.2, 3.18.4, 3.17.10, 3.16.13, 3.15.17, and 3.14.22. This vulnerability was reported via the GitHub Bug Bounty program.

• CWE-601

• https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.22Product, Release Notes
• https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.17Product, Release Notes
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.13Product, Release Notes
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.10Product, Release Notes
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.4Product, Release Notes
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.2Product, Release Notes

Published

Feb 18, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-0567A vulnerability was detected in code-projects Content Manage…9.8
• CVE-2026-0568A flaw has been found in code-projects Online Music Site 1.0…9.8
• CVE-2026-0569A vulnerability has been found in code-projects Online Music…9.8
• CVE-2026-0570A vulnerability was found in code-projects Online Music Site…9.8
• CVE-2026-0571A security flaw has been discovered in yeqifu warehouse up t…6.5
• CVE-2026-0572The WebPurify Profanity Filter plugin for WordPress is vulne…6.5
• CVE-2026-0574A weakness has been identified in yeqifu warehouse up to aaf…8.8
• CVE-2026-0575A security vulnerability has been detected in code-projects …9.8
• CVE-2026-0576A vulnerability was detected in code-projects Online Product…9.8
• CVE-2026-0577A flaw has been found in code-projects Online Product Reserv…9.8
• CVE-2026-0578A vulnerability has been found in code-projects Online Produ…9.8
• CVE-2026-0579A vulnerability was found in code-projects Online Product Re…9.8