CVE-2026-77987
Vulnérabilité critique dans Enterprise Server (GitHub)
Description
A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other ports of the same appliance. Response bodies were not returned to the requester, but response timing acted as an oracle that allowed instance secrets to be extracted character by character. An extracted secret could then be used in a separate interaction with an internal service to obtain remote code execution on the appliance. Exploitation required network access to the instance and was unauthenticated when private mode was disabled, or required any authenticated user when private mode was enabled. This vulnerability affected GitHub Enterprise Server versions 3.17 through 3.22 and was fixed in versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. This vulnerability was reported through the GitHub Bug Bounty program.
Gravité et risque d'exploitation
CVE-2026-77987 obtient un score CVSS de 9.3/10, soit une gravité critique. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.88 %, ce qui la place devant 58.4 % des CVE référencées.
Que faire ?
- Vérifiez si Enterprise Server (versions <3.20.*, <3.21.*, 3.21.0, <3.18.*, 3.17.0, 3.18.0, 3.20.0, 3.19.0, 3.22.0, <3.19.*, <3.17.*, <3.22.*) est présent sur votre parc.
- Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
- À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
- Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.
Références
- https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.21
- https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.15
- https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.12
- https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.8
- https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.6
- https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.1