AI Threat Alert
CVE-2026-77987
AWAITING NVDA server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other...
Full CISO analysis pending enrichment.
How severe is it?
What should I do?
No patch available
Monitor for updates. Consider compensating controls or temporary mitigations.
Which compliance frameworks are affected?
Compliance analysis pending. Sign in for full compliance mapping when available.
Frequently Asked Questions
What is CVE-2026-77987?
A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other ports of the same appliance. Response bodies were not returned to the requester, but response timing acted as an oracle that allowed instance secrets to be extracted character by character. An extracted secret could then be used in a separate interaction with an internal service to obtain remote code execution on the appliance. Exploitation required network access to the instance and was unauthenticated when private mode was disabled, or required any authenticated user when private mode was enabled. This vulnerability affected GitHub Enterprise Server versions 3.17 through 3.22 and was fixed in versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. This vulnerability was reported through the GitHub Bug Bounty program.
Is CVE-2026-77987 actively exploited?
No confirmed active exploitation of CVE-2026-77987 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-77987?
No patch is currently available. Monitor vendor advisories for updates.
What is the CVSS score for CVE-2026-77987?
No CVSS score has been assigned yet.
What are the technical details?
Original Advisory
A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other ports of the same appliance. Response bodies were not returned to the requester, but response timing acted as an oracle that allowed instance secrets to be extracted character by character. An extracted secret could then be used in a separate interaction with an internal service to obtain remote code execution on the appliance. Exploitation required network access to the instance and was unauthenticated when private mode was disabled, or required any authenticated user when private mode was enabled. This vulnerability affected GitHub Enterprise Server versions 3.17 through 3.22 and was fixed in versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. This vulnerability was reported through the GitHub Bug Bounty program.
Weaknesses (CWE)
CWE-208 — Observable Timing Discrepancy: Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Source: MITRE CWE corpus.
References
- docs.github.com/en/enterprise-server@3.17/admin/release-notes
- docs.github.com/en/enterprise-server@3.18/admin/release-notes
- docs.github.com/en/enterprise-server@3.19/admin/release-notes
- docs.github.com/en/enterprise-server@3.20/admin/release-notes
- docs.github.com/en/enterprise-server@3.21/admin/release-notes
- docs.github.com/en/enterprise-server@3.22/admin/release-notes