CVE-2026-8034

A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusion between the validation layer and the HTTP request library. The hostname validation used a different URL parser than the request library, enabling a crafted URL to pass validation while directing the request to an unintended host. Exploitation required network access to the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.16.18, 3.17.15, 3.18.9, 3.19.6, and 3.20.2. This vulnerability was reported via the GitHub Bug Bounty program.

• CWE-436
• CWE-918

• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.15Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.9Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2Release Notes, Vendor Advisory

Published

May 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8031A vulnerability was detected in PicoTronica e-Clinic Healthc…5.5
• CVE-2026-80311The Stripe Payment Forms by WP Full Pay WordPress plugin be…4.3
• CVE-2026-8032A flaw has been found in PicoTronica e-Clinic Healthcare Sys…7.3
• CVE-2026-8033A vulnerability has been found in PicoTronica e-Clinic Healt…5.5
• CVE-2026-80338The CMB2 WordPress plugin before 2.13.0 does not perform any…6.8
• CVE-2026-80339The Payment Plugins for Stripe WooCommerce WordPress plugin …5.3
• CVE-2026-80340The Payment Plugins for PayPal WooCommerce WordPress plugin …5.3
• CVE-2026-80341The Payment Plugins for PayPal WooCommerce WordPress plugin …5.9
• CVE-2026-80342The Payment Plugins for PayPal WooCommerce WordPress plugin …6.5
• CVE-2026-80346StarRocks performs no privilege check when a legacy synchron…7.1
• CVE-2026-80347mcp-fetch checks a fetch target against its SSRF guard witho…7.5
• CVE-2026-80348TarsWeb enforces its per-application roles by calling AuthSe…8.8