CVE-2026-8034

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-8034
A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusion between the validation layer and the HTTP request library. The hostname validation used a different URL parser than the request library, enabling a crafted URL to pass validation while directing the request to an unintended host. Exploitation required network access to the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.16.18, 3.17.15, 3.18.9, 3.19.6, and 3.20.2. This vulnerability was reported via the GitHub Bug Bounty program.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18 Release Notes Vendor Advisory
https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.15 Release Notes Vendor Advisory
https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.9 Release Notes Vendor Advisory
https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6 Release Notes Vendor Advisory
https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2 Release Notes Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
History

11 May 2026, 17:18

Type Values Removed Values Added
First Time Github
Github enterprise Server
CPE cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
References () https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18 - () https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18 - Release Notes, Vendor Advisory
References () https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.15 - () https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.15 - Release Notes, Vendor Advisory
References () https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.9 - () https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.9 - Release Notes, Vendor Advisory
References () https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6 - () https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6 - Release Notes, Vendor Advisory
References () https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2 - () https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2 - Release Notes, Vendor Advisory

07 May 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-05-07 22:16

Updated : 2026-05-11 17:18

NVD link : CVE-2026-8034

Mitre link : CVE-2026-8034

CVE.ORG link : CVE-2026-8034

JSON object : View

Products Affected

github

  • enterprise_server
CWE
CWE-436

Interpretation Conflict

CWE-918

Server-Side Request Forgery (SSRF)