CVE-2026-18730— Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token
Quick assessment
Affected
GitHub Enterprise Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 GitHub Enterprise Server 中发现了一个服务器端请求伪造（SSRF）漏洞，该漏洞允许未经身份验证的攻击者诱导 Manage API 向攻击者控制的宿主发送精心构造的外发请求。该漏洞源于一个无需认证即可访问的端点：该端点会解析攻击者提供的集群配置，并发出网关到代理（gateway-to-agent）请求；这些请求使用的 HMAC 认证仅覆盖时间戳，而未包含请求路径或请求体。处于有利位置、能够拦截外发请求的攻击者可以捕获该 HMAC 令牌，并将其重放至拥有较高权限的管理代理端点。由于拓扑结构的
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-18730
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token
Source: CVE Program / CVE List V5
Vulnerability Description
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster configuration and issued gateway-to-agent requests whose HMAC authenticated only a timestamp, not the request path or body. An attacker positioned to intercept the outbound request could capture this token and replay it against privileged management agent endpoints. High-availability deployments were not affected due to a topology restriction. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.19, 3.18.13, 3.19.10, 3.20.6, and 3.21.4. This vulnerability was reported via the GitHub Bug Bounty program.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| GitHub | Enterprise Server | 3.17.0 ~ 3.17.18 | - |
|
II. Public POCs for CVE-2026-18730
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-18730
请登录查看更多情报信息。
Same Patch Batch · GitHub · 2026-09-01 · 3 CVEs total
| CVE-2026-19118 | 7.7 HIGH | Race condition vulnerability was identified in GitHub Enterprise Server that allowed remot |
| CVE-2026-76851 | 7.7 HIGH | Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code |
IV. Related Vulnerabilities
Same product: Enterprise Server
-
CVE-2026-76851
Server-Side Request Forgery vulnerability in GitHub Enterpri -
CVE-2026-19118
Race condition vulnerability was identified in GitHub Enterp -
CVE-2026-15996
Denial of service vulnerability in GitHub Enterprise Server -
CVE-2026-17556
Path traversal in GitHub Enterprise Server allowed unauthent -
CVE-2026-15783
Missing Authorization vulnerability was identified in GitHub
Same vendor: GitHub
-
CVE-2026-76851
Server-Side Request Forgery vulnerability in GitHub Enterpri -
CVE-2026-19118
Race condition vulnerability was identified in GitHub Enterp -
CVE-2026-15996
Denial of service vulnerability in GitHub Enterprise Server -
CVE-2026-17556
Path traversal in GitHub Enterprise Server allowed unauthent -
CVE-2026-47427
GitHub MCP Server: Nil Pointer Dereference DoS in completion
Same weakness: CWE-918
V. Comments for CVE-2026-18730
No comments yet