CVE-2026-77987: SSRF to RCE in notebook viewer

CISO Take

A critical flaw in the GitHub Enterprise Server notebook viewer lets an attacker steer server-side requests to internal services on other ports, then use response timing to extract instance secrets one character at a time and chain them into remote code execution on the appliance. It is unauthenticated when private mode is off and needs only a low-privilege authenticated account when private mode is on, so exposure is broad for any internet- or intranet-reachable instance. Current exploitation signals are modest: EPSS is 0.0068 (around the 49th percentile), it is not in CISA KEV, and there is no public exploit or Nuclei template, although CISA SSVC marks it TRACK_STAR and the CVSS score is 9.8. GHES holds source code, CI secrets and deployment credentials that feed ML training and model-release pipelines, so a compromise has a large downstream blast radius. Upgrade to 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15 or 3.17.21 (the fixed release for your branch), and review exposure of any instance with private mode disabled.

Sources:NVDEPSSCISA SSVCATLASdocs.github.com

What is the risk?

Severity is critical (CVSS 9.8): network-reachable, low complexity, no user interaction, and no authentication when private mode is disabled. Near-term exploitation likelihood is low to moderate (EPSS 0.0068, no public PoC, not in KEV), but the timing side-channel plus secret-to-RCE chain is a repeatable technique that skilled attackers can reproduce from the patch diff. The AI/ML angle is indirect: GHES is a code and secrets platform that commonly hosts AI/ML repositories, CI runners and model-release workflows. Confidence: HIGH on technical details (vendor advisory), MEDIUM on exploitation likelihood.

How does the attack unfold?

Initial Access

Attacker sends a crafted URL with a non-standard port to the GHES notebook viewer, unauthenticated or as any user.

AML.T0049

Secret Extraction

Response timing is used as an oracle to extract internal instance secrets character by character.

AML.T0106

Remote Code Execution

The extracted secret is used against an internal service to execute code on the appliance.

Impact

Attacker steals repositories and CI secrets and can tamper with AI/ML build and release pipelines.

AML.T0010.001

Initial Access

Attacker sends a crafted URL with a non-standard port to the GHES notebook viewer, unauthenticated or as any user.

AML.T0049

Secret Extraction

Response timing is used as an oracle to extract internal instance secrets character by character.

AML.T0106

Remote Code Execution

The extracted secret is used against an internal service to execute code on the appliance.

Impact

Attacker steals repositories and CI secrets and can tamper with AI/ML build and release pipelines.

AML.T0010.001

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.9%

chance of exploitation in 30 days

Higher than 59% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade GHES to a fixed release: 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15 or 3.17.21. 2) Until patched, enable private mode, restrict network access to the instance to trusted ranges/VPN, and where feasible limit access to the notebook rendering feature. 3) Detection: review GHES logs for notebook viewer requests carrying URLs with non-standard ports, internal hostnames or loopback addresses, and for bursts of repetitive requests from one source that suggest timing-oracle probing. 4) Assume exposure if the instance was reachable and unpatched: rotate instance secrets, Actions secrets, deploy keys and tokens, and audit for unexpected admin changes, new SSH keys, or modified workflows. 5) Review audit logs for anomalous processes or outbound connections from the appliance.

What does CISA's SSVC say?

DecisionTrack*

Exploitationnone

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionData ExtractionAuth BypassFrameworkAML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials AML.T0106- Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-77987?

A critical flaw in the GitHub Enterprise Server notebook viewer lets an attacker steer server-side requests to internal services on other ports, then use response timing to extract instance secrets one character at a time and chain them into remote code execution on the appliance. It is unauthenticated when private mode is off and needs only a low-privilege authenticated account when private mode is on, so exposure is broad for any internet- or intranet-reachable instance. Current exploitation signals are modest: EPSS is 0.0068 (around the 49th percentile), it is not in CISA KEV, and there is no public exploit or Nuclei template, although CISA SSVC marks it TRACK_STAR and the CVSS score is 9.8. GHES holds source code, CI secrets and deployment credentials that feed ML training and model-release pipelines, so a compromise has a large downstream blast radius. Upgrade to 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15 or 3.17.21 (the fixed release for your branch), and review exposure of any instance with private mode disabled.

Is CVE-2026-77987 actively exploited?

No confirmed active exploitation of CVE-2026-77987 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-77987?

1) Upgrade GHES to a fixed release: 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15 or 3.17.21. 2) Until patched, enable private mode, restrict network access to the instance to trusted ranges/VPN, and where feasible limit access to the notebook rendering feature. 3) Detection: review GHES logs for notebook viewer requests carrying URLs with non-standard ports, internal hostnames or loopback addresses, and for bursts of repetitive requests from one source that suggest timing-oracle probing. 4) Assume exposure if the instance was reachable and unpatched: rotate instance secrets, Actions secrets, deploy keys and tokens, and audit for unexpected admin changes, new SSH keys, or modified workflows. 5) Review audit logs for anomalous processes or outbound connections from the appliance.

What systems are affected by CVE-2026-77987?

This vulnerability affects the following AI/ML architecture patterns: Source code and CI/CD platforms hosting ML code, Training pipelines, Model release and deployment pipelines, Data science notebook workflows, AI supply chain (internal package and artifact feeds).

What is the CVSS score for CVE-2026-77987?

CVE-2026-77987 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.88%.

What is the AI security impact?

Affected AI Architectures

Source code and CI/CD platforms hosting ML codeTraining pipelinesModel release and deployment pipelinesData science notebook workflowsAI supply chain (internal package and artifact feeds)

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

AML.T0106Exploitation for Credential Access

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other ports of the same appliance. Response bodies were not returned to the requester, but response timing acted as an oracle that allowed instance secrets to be extracted character by character. An extracted secret could then be used in a separate interaction with an internal service to obtain remote code execution on the appliance. Exploitation required network access to the instance and was unauthenticated when private mode was disabled, or required any authenticated user when private mode was enabled. This vulnerability affected GitHub Enterprise Server versions 3.17 through 3.22 and was fixed in versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. This vulnerability was reported through the GitHub Bug Bounty program.

Exploitation Scenario

An attacker reaches a GHES instance with private mode disabled, or signs in with any ordinary account when it is enabled. They submit notebook viewer URLs pointing at internal services on the appliance using non-default ports and measure response times. Because response bodies are not returned, they use timing differences to extract an internal secret character by character. They then present the secret to an internal service to execute code on the appliance. From there they harvest repository contents and CI secrets, including credentials for ML training infrastructure and model registries, and can implant malicious code in AI/ML build or release pipelines.

Weaknesses (CWE)

CWE-208Observable Timing Discrepancy CWE-208Observable Timing Discrepancy CWE-918Server-Side Request Forgery CWE-918Server-Side Request Forgery

CWE-208 — Observable Timing Discrepancy: Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Source: MITRE CWE corpus.