CVE-2026-110288— Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Console

Quick assessment

Affected

GitHub Enterprise Server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 GitHub Enterprise Server 中发现了一处跨站请求伪造（CSRF）漏洞。该漏洞允许未认证的攻击者通过诱导已认证的 Management Console（管理控制台）操作员浏览器向集成移除端点发送缺少 CSRF 令牌的跨站 GET 请求，从而删除已存储的 Slack 和 Microsoft Teams ChatOps 配置及提供者凭据。利用此漏洞需要满足以下条件：系统已配置 ChatOps 集成，且操作员在登录 Management Console 的同时访问了由攻击者控制的内容。漏洞被利用后

CVSS 5.3 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Console

Source: CVE Program / CVE List V5

Vulnerability Description

A cross-site request forgery vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete stored Slack and Microsoft Teams ChatOps configuration and provider credentials by inducing an authenticated Management Console operator's browser to send a cross-site GET request to the integration removal endpoint without a CSRF token. Exploitation required configured ChatOps integrations and an operator visiting attacker-controlled content while signed in to the Management Console; deletion could disrupt ChatOps notifications and commands when configuration was applied or services reloaded. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.23 and was fixed in versions 3.19.14, 3.20.10, 3.21.8, and 3.22.3. This vulnerability was reported via the GitHub Bug Bounty program.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

跨站请求伪造(CSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
GitHub	Enterprise Server	3.19.0 ~ 3.19.*	-

II. Public POCs for CVE-2026-110288

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-110288

请登录查看更多情报信息。

Other References for CVE-2026-110288 (4)

https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14 release-notes
https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8 release-notes
https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3 release-notes
https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10 release-notes

https://www.cve.org/CVERecord?id=CVE-2026-110288

Same Patch Batch · GitHub · 2026-11-03 · 3 CVEs total

CVE-2026-104608	7.7 HIGH	Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in
CVE-2026-118237	5.3 MEDIUM	Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process

IV. Related Vulnerabilities

Same product: Enterprise Server

Same vendor: GitHub

Same weakness: CWE-352