CVE-2026-18730: 
GitHub Enterprise Server vulnerability analysis and mitigation

CVE-2026-18730 is a Server-Side Request Forgery (SSRF) vulnerability in GitHub Enterprise Server (GHES) that allows an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. The vulnerability affects all GHES versions prior to 3.22, specifically versions 3.17.0–3.17.18, 3.18.0–3.18.12, 3.19.0–3.19.9, 3.20.0–3.20.5, and 3.21.0–3.21.3. High-availability deployments are not affected due to a topology restriction. It was disclosed on September 1, 2026, and reported via the GitHub Bug Bounty program. The vulnerability carries a CVSS v3.1 base score of 7.4 (High) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, GHES 3.17 Release Notes).

The root cause is classified as CWE-918 (Server-Side Request Forgery). An unauthenticated endpoint in the Manage API accepts and parses attacker-supplied cluster configuration data, then issues internal gateway-to-agent requests authenticated via HMAC. Critically, the HMAC signature validates only a timestamp — not the request path or body — making the resulting token replayable against any privileged management agent endpoint. An attacker positioned to intercept the outbound request (e.g., via a man-in-the-middle position on the network path between the GHES instance and the attacker-controlled host) can capture this weakly-scoped bearer token and replay it to interact with privileged internal management services (GitHub Advisory, GHES 3.21 Release Notes).

Successful exploitation allows an unauthenticated network attacker to capture a replayable management bearer token and use it to execute arbitrary operations against privileged management agent endpoints on the GHES instance. This can result in high confidentiality impact (unauthorized access to sensitive management data) and high integrity impact (unauthorized system manipulation), though availability is not directly affected. The vulnerability is limited to non-high-availability deployments due to a topology restriction, but affected instances — which may host sensitive source code, secrets, and CI/CD pipelines — represent a significant risk of unauthorized system manipulation and data exposure (GitHub Advisory, GHES 3.20 Release Notes).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.31%, reflecting a low current probability of exploitation. Exploitation requires a network-adjacent attacker capable of intercepting outbound requests from the GHES instance, which raises the practical bar for exploitation (CVSS v3.1 Attack Complexity: High). No threat actor attribution has been reported.

1. Reconnaissance: Identify a non-HA GitHub Enterprise Server instance running a vulnerable version (3.17.0–3.17.18, 3.18.0–3.18.12, 3.19.0–3.19.9, 3.20.0–3.20.5, or 3.21.0–3.21.3) that is network-accessible.
2. Position for interception: Establish a network position capable of intercepting outbound HTTP/HTTPS requests from the GHES instance to an attacker-controlled host (e.g., via DNS poisoning, BGP hijacking, or a rogue server on the same network segment).
3. Trigger the SSRF: Send a crafted unauthenticated request to the vulnerable Manage API endpoint, supplying a malicious cluster configuration that causes the server to issue a gateway-to-agent request directed at the attacker-controlled host.
4. Capture the HMAC token: Intercept the outbound request from the GHES instance and extract the HMAC-authenticated bearer token, which is signed only over a timestamp and is therefore replayable.
5. Replay against privileged endpoints: Use the captured bearer token to send authenticated requests directly to privileged management agent endpoints on the GHES instance, potentially executing arbitrary management operations or accessing sensitive data (GitHub Advisory, GHES 3.19 Release Notes).

• Network: Unexpected outbound HTTP/HTTPS connections from the GHES instance to unknown or external hosts originating from the Manage API service; unusual traffic patterns to management agent ports from external IP addresses.
• Logs: Unauthenticated requests to the Manage API cluster configuration endpoint in GHES access logs, particularly from unfamiliar source IPs; repeated or anomalous requests to internal management agent endpoints with bearer tokens not associated with legitimate administrative sessions.
• Process/Service: Unexpected management agent operations (configuration changes, service restarts, data queries) not correlated with known administrator activity in audit logs.

GitHub has released patched versions addressing CVE-2026-18730: 3.17.19, 3.18.13, 3.19.10, 3.20.6, and 3.21.4 (or later, including 3.22+). Administrators should upgrade to one of these versions as the primary remediation. High-availability deployments are not affected and do not require immediate action for this specific vulnerability. No configuration-based workaround has been published; upgrading is the only supported fix (GHES 3.17 Release Notes, GHES 3.18 Release Notes, GHES 3.21 Release Notes).

The vulnerability was reported through the GitHub Bug Bounty program and disclosed alongside several other HIGH-severity GHES vulnerabilities in the same patch cycle, including CVE-2026-19118 and CVE-2026-76851. GitHub's official release notes across all affected branches consistently describe the issue and credit the bug bounty reporter. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability aggregator coverage (GitHub Advisory).