CVE-2026-8606

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP requests to internal services via the security advisories package lookup feature. By directing requests to an internal management service and measuring response timing, an attacker could infer the values of sensitive environment variables, including signing secrets and private keys. Exploitation required GitHub Packages to be enabled; on instances not running in private mode the vulnerability was exploitable without authentication, otherwise any authenticated user could exploit it. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21.1 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, 3.17.16, and 3.16.19. This vulnerability was reported via the GitHub Bug Bounty program.

• CWE-918

• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.19Product, Release Notes
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.16Product, Release Notes
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.10Product, Release Notes
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.7Product, Release Notes
• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.3Product, Release Notes
• https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.1Product, Release Notes

Published

May 27, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8598An undocumented configuration export port is accessible on s…9.1
• CVE-2026-8599The MailerPress – Email Marketing, Newsletter, Email Automat…6.4
• CVE-2026-8602In ScadaBR version 1.2.0, a Missing Authentication for Criti…9.1
• CVE-2026-8603In ScadaBR version 1.2.0, an OS Command Injection vulnerabil…9.8
• CVE-2026-8604In ScadaBR version 1.2.0, a CSRF vulnerability could allow a…8.8
• CVE-2026-8605In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vu…9.8
• CVE-2026-8607The Points Management System For Gamification, Ranks, Badges…6.4
• CVE-2026-8608The Event Monster – Event Management, Events Calendar, Ticke…5.3
• CVE-2026-8609An unauthenticated attacker can repeatedly call Grafana's OA…7.5
• CVE-2026-8610The TypeSquare Webfonts for ConoHa plugin for WordPress is v…4.3
• CVE-2026-8611The Klamra Paycal for Aspaclaria plugin for WordPress is vul…4.3
• CVE-2026-8612WWW::Mechanize::Cached versions before 2.00 for Perl deseria…5.3