CVE-2026-76851

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests to a privileged service, leading to elevated code execution. Exploitation required pre-receive hook networking to be enabled and either site administrator privileges or write access to a repository containing a configured pre-receive hook. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. This vulnerability was reported via the GitHub Bug Bounty program.

• CWE-918

• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.20Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.14Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.11Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.7Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.5Release Notes, Vendor Advisory

Published

Sep 1, 2026

Last Modified

Sep 8, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76845adm-zip 0.5.9 through 0.6.0 follows symbolic links at the ex…6.5
• CVE-2026-76846Grav before 2.0.16 contains an incomplete default denylist i…7.5
• CVE-2026-76847act starts an HTTP Artifacts V4 backend whenever a workflow …8.8
• CVE-2026-76848Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-7685A vulnerability was detected in Edimax BR-6208AC up to 1.02.…8.8
• CVE-2026-76850LMDeploy deserializes disaggregated-serving peer messages wi…9.8
• CVE-2026-76852Netcore NR268 firmware version 1.7.121109 has an improper in…8.8
• CVE-2026-76853Netcore NR268 firmware version 1.7.121109 contains a securit…8.1
• CVE-2026-76854Netcore NR255-V version 1.5.130703 contains a sensitive info…6.5
• CVE-2026-76855Netcore NR255-V version 1.5.130703 contains a sensitive info…6.5
• CVE-2026-76856Netcore NR255-V firmware version 1.5.130703 contains a cross…8.1
• CVE-2026-76857Netcore NR255-V firmware version 1.5.130703 contains a sensi…6.5