CVE-2026-96890

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret scanning validator for GCP service account credentials trusted the token endpoint embedded in a committed credential and issued a request to it without restricting the destination. Exploitation required an authenticated user with permission to push to a repository on an instance with GitHub Advanced Security and secret scanning validity checks enabled, a non-default configuration. This vulnerability affected GitHub Enterprise Server 3.20, 3.21, and 3.22 and was fixed in versions 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported through the GitHub Bug Bounty program.

• CWE-918

• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.9Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.7Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.2Release Notes, Vendor Advisory

Published

Oct 6, 2026

Last Modified

Oct 9, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-96883pgcollection is an open source extension to PostgreSQL. A ty…8.8
• CVE-2026-96884A security flaw has been discovered in MantisZip up to 0.4.5…6.3
• CVE-2026-96886The Course Booking System WordPress plugin before 7.0.9 does…5.3
• CVE-2026-96888A BIND resolver that is configured with both a "redirect" zo…7.5
• CVE-2026-96889A flaw was found in librsvg. When processing an SVG document…7.8
• CVE-2026-9689A flaw was found in Keycloak, an open-source identity and ac…4.2
• CVE-2026-96891A vulnerability was identified in D-Link DIR-825 3.00b32. Af…9.8
• CVE-2026-96892A flaw has been found in Edimax BR-6428nC 1.16. The impacted…4.3
• CVE-2026-96893GitLab has remediated an issue in GitLab EE affecting all ve…7.3
• CVE-2026-96894The ERP: Complete HR, Accounting & CRM Suite Built for WooCo…7.2
• CVE-2026-96895The WP YouTube Lyte WordPress plugin before 1.7.31 does not …6.8
• CVE-2026-96896The Malcure Malware Shield — Removal, Repair, Monitor WordPr…7.2