Loading story…
GitHub released security updates for GitHub Enterprise Server (GHES) that remediate CVE-2026-77987, a critical server-side request forgery (SSRF)-style vulnerability in the notebook viewer. A network-accessible attacker could use a viewer URL containing an explicit port to probe co-located internal services; response timing could disclose appliance secrets and potentially enable remote code execution. The updates also fix CVE-2026-77912, a high-severity stored cross-site scripting vulnerability through which an authenticated attacker could inject arbitrary HTML attributes using crafted Markdown, execute scripts in other users’ browsers, steal data, perform victim-authorized actions, or self-propagate.
Affected GHES installations should be upgraded to the applicable fixed version: 3.17.21, 3.18.15, 3.19.12, 3.20.8, 3.21.6, or 3.22.1. The releases additionally correct an authorization issue that could let a party holding package-upload identifiers corrupt an in-progress GitHub Packages upload, alongside reliability issues affecting Dependabot, Redis recovery, backup and restore, and resource consumption. Administrators should reapply custom firewall rules after upgrading because the upgrade process removes them.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
GitHub released GHES 3.22.1 and published a security advisory covering affected 3.17 through 3.22 release branches. The updates fixed critical SSRF-style flaw CVE-2026-77987, high-severity stored XSS CVE-2026-77912, and a GitHub Packages upload authorization flaw; fixed releases included 3.17.21, 3.18.15, 3.19.12, 3.20.8, 3.21.6, and 3.22.1.
GitHub released GitHub Enterprise Server 3.22.0, adding a replication controller, CodeQL 2.25.6 with incremental pull-request analysis, Dependabot alerts for known malicious npm packages, and additional hook-networking restrictions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitHub released urgent security updates for GitHub Enterprise Server to fix multiple severe vulnerabilities affecting versions `3.16` through `3.20`, led by **CVE-2026-9312**, a critical pre-authentication SSRF flaw in an upload endpoint. The bug allowed unauthenticated attackers to craft requests with path traversal content and force the appliance to make internal HTTP requests, potentially exposing internal services, credentials, and configuration data. GitHub said the issue was reported through its bug bounty program and remediated in `3.16.20`, `3.17.17`, `3.18.11`, `3.19.8`, `3.20.4`, and `3.21.1`. The updates also address the high-severity Linux kernel local privilege-escalation flaws **CVE-2026-43284** and **CVE-2026-43500**, known as **Dirty Frag**, which could let a local user gain root on vulnerable appliances. Additional fixes and hardening cover a timing side-channel issue and another SSRF-related weakness tied to package and notebook-related functionality, including environments with GitHub Packages enabled or private mode disabled. GitHub revoked the signing key for GHES release packages and instructed administrators to rotate trusted local GPG public keys before installing the patched releases, urging rapid upgrades for internet-facing and shared multi-tenant deployments.
Jul 20, 2026
GitHub released security updates for a high-severity vulnerability in **GitHub Enterprise Server** that could let an unauthenticated remote attacker delete arbitrary files and directories on affected instances. Tracked as **`CVE-2026-17556`**, the bug is a **path traversal** issue caused by unsanitized use of the `X-GitHub-Request-Id` header as part of a filesystem path for an upload buffer directory, which can then be recursively removed by a cleanup routine. The flaw is rated **CVSS 8.8** and mapped to **`CWE-22`**. According to the advisories, the issue affects all GitHub Enterprise Server versions prior to **3.22**, including **3.21.x before 3.21.4**, **3.20.x before 3.20.6**, **3.19.x before 3.19.10**, **3.18.x before 3.18.13**, and **3.17.x before 3.17.19**. The vulnerability requires only network access, does not require authentication, and remains exploitable even when private mode is enabled. Authorities and vendor guidance recommend upgrading immediately to the fixed releases referenced in GitHub’s security bulletins.
Aug 6, 2026
A researcher disclosed a four-vulnerability chain that enabled unauthenticated remote code execution on GitHub Enterprise versions before `2.8.7`. The attack began with a WebHook server-side request forgery (SSRF) bypass using an unusual IP-address representation to evade Faraday restrictions, then used a second SSRF flaw to reach the internal Graphite service. A CRLF injection in Python's `HTTPConnection` allowed protocol smuggling to internal Memcached, where an attacker could plant a malicious Ruby Marshal object in cache. When GitHub Enterprise deserialized the poisoned object, it executed attacker-controlled commands. GitHub validated the report and released version `2.8.7`, adding SSRF and internal network-access protections.
Sep 3, 2026