CVE-2026-8034

A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusion between the validation layer and the HTTP request library. The hostname validation used a different URL parser than the request library, enabling a crafted URL to pass validation while directing the request to an unintended host. Exploitation required network access to the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.16.18, 3.17.15, 3.18.9, 3.19.6, and 3.20.2. This vulnerability was reported via the GitHub Bug Bounty program.

• CWE-436
• CWE-918

• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.15Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.9Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2Release Notes, Vendor Advisory

Published

May 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8027A weakness has been identified in FlowiseAI Flowise up to 3.…5.3
• CVE-2026-8028A vulnerability was detected in FlowiseAI Flowise up to 3.0.…3.7
• CVE-2026-8029The ZTE Smart Life app contains an SQL injection vulnerabili…3.9
• CVE-2026-8031A vulnerability was detected in PicoTronica e-Clinic Healthc…5.5
• CVE-2026-8032A flaw has been found in PicoTronica e-Clinic Healthcare Sys…7.3
• CVE-2026-8033A vulnerability has been found in PicoTronica e-Clinic Healt…5.5
• CVE-2026-8035Improper input validation in the NI-PAL kernel driver may al…5.5
• CVE-2026-8036Improper input validation in NI-PAL may allow a local authen…7.8
• CVE-2026-8037OS Command Injection Remote Code Execution Vulnerability in …9.8
• CVE-2026-8038The Faces of Users plugin for WordPress is vulnerable to Sto…6.4
• CVE-2026-8039The Fancy Testimonials plugin for WordPress is vulnerable to…6.4
• CVE-2026-8040The faq shortocde plugin for WordPress is vulnerable to Stor…6.4