CVE-2026-8606

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP requests to internal services via the security advisories package lookup feature. By directing requests to an internal management service and measuring response timing, an attacker could infer the values of sensitive environment variables, including signing secrets and private keys. Exploitation required GitHub Packages to be enabled; on instances not running in private mode the vulnerability was exploitable without authentication, otherwise any authenticated user could exploit it. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21.1 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, 3.17.16, and 3.16.19. This vulnerability was reported via the GitHub Bug Bounty program.

• CWE-918

• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.19Product, Release Notes
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.16Product, Release Notes
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.10Product, Release Notes
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.7Product, Release Notes
• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.3Product, Release Notes
• https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.1Product, Release Notes

Published

May 27, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86043Skipper is an HTTP router and reverse proxy for service comp…7.5
• CVE-2026-86049Jupyter Server is the backend for Jupyter web applications. …7.1
• CVE-2026-8605In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vu…9.8
• CVE-2026-86054Notepad++ is a free and open-source source code editor. Prio…7.8
• CVE-2026-86056Notepad++ is a free and open-source source code editor. Prio…5.5
• CVE-2026-86059Dokploy is a free, self-hostable Platform as a Service (PaaS…9.6
• CVE-2026-86060RouterOS contains an argument-handling flaw in the SSH login…9.8
• CVE-2026-86062LightRAG provides simple and fast retrieval-augmented genera…6.1
• CVE-2026-86064Klever-Go is the Go implementation of the Klever blockchain …8.6
• CVE-2026-86065Klever-Go is the Go implementation of the Klever blockchain …7.5
• CVE-2026-86066Horilla is an HR and CRM software. Prior to 2.0.0, approve_v…5.9
• CVE-2026-8607The Points Management System For Gamification, Ranks, Badges…6.4