CVE-2026-9312

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-9312
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to send crafted requests to internal services by exploiting insufficient input validation in an upload endpoint. By injecting path traversal content into request parameters, an attacker could bypass the intended request flow and redirect internal API calls, potentially accessing internal services and exposing sensitive credentials. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, 3.20.4, and 3.21.2. This vulnerability was reported via the GitHub Bug Bounty program.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.17 Product Release Notes
https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.11 Product Release Notes
https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.8 Product Release Notes
https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.4 Product Release Notes
https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.2
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:3.21.1:rc1:*:*:*:*:*:*
History

23 Jul 2026, 11:10

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) fue identificada en GitHub Enterprise Server que permitía a un atacante no autenticado enviar peticiones manipuladas a servicios internos explotando una validación de entrada insuficiente en un punto final de carga. Al inyectar contenido de salto de ruta en los parámetros de la petición, un atacante podría eludir el flujo de petición previsto y redirigir llamadas internas a la API, accediendo potencialmente a servicios internos y exponiendo credenciales sensibles. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server anteriores a la 3.22 y fue corregida en las versiones 3.16.20, 3.17.17, 3.18.11, 3.19.8, 3.20.4 y 3.21.1. Esta vulnerabilidad fue reportada a través del programa de recompensas por errores de GitHub.

30 Jun 2026, 21:16

Type Values Removed Values Added
References
  • {'url': 'https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.20', 'tags': ['Product', 'Release Notes'], 'source': 'product-cna@github.com'}
  • {'url': 'https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.1', 'tags': ['Product', 'Release Notes'], 'source': 'product-cna@github.com'}
  • () https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.2 -
Summary (en) A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to send crafted requests to internal services by exploiting insufficient input validation in an upload endpoint. By injecting path traversal content into request parameters, an attacker could bypass the intended request flow and redirect internal API calls, potentially accessing internal services and exposing sensitive credentials. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.16.20, 3.17.17, 3.18.11, 3.19.8, 3.20.4, and 3.21.1. This vulnerability was reported via the GitHub Bug Bounty program. (en) A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to send crafted requests to internal services by exploiting insufficient input validation in an upload endpoint. By injecting path traversal content into request parameters, an attacker could bypass the intended request flow and redirect internal API calls, potentially accessing internal services and exposing sensitive credentials. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, 3.20.4, and 3.21.2. This vulnerability was reported via the GitHub Bug Bounty program.

02 Jun 2026, 18:31

Type Values Removed Values Added
References () https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.20 - () https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.20 - Product, Release Notes
References () https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.17 - () https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.17 - Product, Release Notes
References () https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.11 - () https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.11 - Product, Release Notes
References () https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.8 - () https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.8 - Product, Release Notes
References () https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.4 - () https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.4 - Product, Release Notes
References () https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.1 - () https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.1 - Product, Release Notes
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.2
CPE cpe:2.3:a:github:enterprise_server:3.21.1:rc1:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
First Time Github enterprise Server
Github

27 May 2026, 00:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-05-27 00:16

Updated : 2026-07-23 11:10

NVD link : CVE-2026-9312

Mitre link : CVE-2026-9312

CVE.ORG link : CVE-2026-9312

JSON object : View

Products Affected

github

  • enterprise_server
CWE
CWE-918

Server-Side Request Forgery (SSRF)