CVE-2026-18730

A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster configuration and issued gateway-to-agent requests whose HMAC authenticated only a timestamp, not the request path or body. An attacker positioned to intercept the outbound request could capture this token and replay it against privileged management agent endpoints. High-availability deployments were not affected due to a topology restriction. This vulnerability affected GitHub Enterprise Server releases in the 3.17, 3.18, 3.19, 3.20, and 3.21 series and was fixed in versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6. This vulnerability was reported via the GitHub Bug Bounty program.

• CWE-918

• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.21
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.15
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.12
• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.8
• https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.6

Published

Sep 1, 2026

Last Modified

Sep 22, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18722A vulnerability was found in diaowen DWSurvey up to 6.14.0. …6.3
• CVE-2026-18723A vulnerability was determined in diaowen DWSurvey up to 6.1…6.3
• CVE-2026-18726A flaw was found in open-iscsi. This vulnerability allows a …6.5
• CVE-2026-18727A flaw was found in open-iscsi's iscsiuio component. This vu…6.5
• CVE-2026-18728A flaw was found in open-iscsi. An integer underflow vulnera…6.5
• CVE-2026-18729IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote a…8.8
• CVE-2026-18733A prompt injection vulnerability in the shell tool in Amazon…8.8
• CVE-2026-18736Shlink contains a server-side request forgery vulnerability …5
• CVE-2026-18737Shlink contains a blind SQL injection vulnerability that all…6.5
• CVE-2026-18738Shlink versions 5.0.0 through 5.1.5 contain a CSV formula in…4.7
• CVE-2026-18739A flaw was found in popt, a command-line option parsing libr…2.5
• CVE-2026-1874Always-Incorrect Control Flow Implementation vulnerability i…7.5