CVE-2026-18730 in GitHub
Summary
by MITRE • 09/01/2026
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster configuration and issued gateway-to-agent requests whose HMAC authenticated only a timestamp, not the request path or body. An attacker positioned to intercept the outbound request could capture this token and replay it against privileged management agent endpoints. High-availability deployments were not affected due to a topology restriction. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.19, 3.18.13, 3.19.10, 3.20.6, and 3.21.4. This vulnerability was reported via the GitHub Bug Bounty program.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The identified security flaw represents a critical server-side request forgery (SSRF) vulnerability within GitHub Enterprise Server, specifically targeting the Manage API infrastructure used for cluster management operations. The core technical deficiency lies in how the system processes unauthenticated endpoint inputs related to cluster configuration. When an attacker supplies crafted data through this interface, the server initiates outbound requests intended for gateway-to-agent communication channels. These internal communications rely on Hash-based Message Authentication Codes (HMAC) to verify integrity and authenticity. However, the implementation of these HMAC tokens is flawed because they authenticate only a timestamp component rather than encompassing the full request context such as the URL path or message body. This incomplete authentication mechanism creates a significant gap in security validation, allowing an adversary who can intercept the outbound traffic from the server to capture the generated token without needing valid credentials for the target management agents.
The operational impact of this vulnerability is severe due to its unauthenticated nature and the potential for request replay attacks. An attacker positioned on the network path between the GitHub Enterprise Server instance and its internal management agents can sniff the outgoing HTTP requests containing these weakly authenticated tokens. Once captured, the timestamp-based token remains valid within a specific time window defined by the server's clock synchronization settings. The adversary can then replay this stolen token against privileged management agent endpoints to execute arbitrary commands or manipulate cluster configurations without detection through standard authentication checks. This capability effectively bypasses access controls designed to protect sensitive administrative interfaces, potentially leading to full compromise of the enterprise deployment’s control plane. It is important to note that high-availability deployments were not affected by this specific vector due to inherent topology restrictions that prevented the exploitation path from being viable in those configurations.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF) as it involves forcing the server to make requests on behalf of an attacker-controlled entity or context. Furthermore, the technique of capturing and reusing authentication tokens corresponds to ATT&CK Tactic TA0005 Defense Evasion and specifically relates to techniques involving credential access and misuse of valid credentials for lateral movement within internal networks. The flaw highlights a common pitfall in microservices architectures where inter-service communication relies on shared secrets or time-based tokens without sufficient binding to the specific request parameters, thereby enabling replay attacks if network traffic is compromised.
Mitigation strategies must prioritize immediate patching as this vulnerability affects all versions of GitHub Enterprise Server prior to version 3.22. Administrators should upgrade their instances to one of the fixed releases: 3.17.19, 3.18.13, 3.19.10, 3.20.6, or 3.21.4. These updates address the underlying code logic that fails to bind HMAC signatures to request paths and bodies. In addition to patching, organizations should implement network segmentation strategies to restrict direct communication between web-facing components and internal management agents where possible. Utilizing mutual TLS (mTLS) for all inter-service communications adds a layer of cryptographic verification beyond simple timestamp-based tokens, ensuring that even if traffic is intercepted, the connection cannot be established without valid client certificates. Regular audits of authentication mechanisms in API endpoints are essential to prevent similar weaknesses involving partial or weak signature validation from recurring in future development cycles.