CVE-2026-77987: 
GitHub Enterprise Server vulnerability analysis and mitigation

CVE-2026-77987 is a Server-Side Request Forgery (SSRF) vulnerability in the notebook viewer component of GitHub Enterprise Server (GHES) that can lead to remote code execution on the appliance. The notebook viewer validated the scheme and host of user-supplied URLs but failed to validate the port, allowing requests to be directed to internal services on other ports of the same appliance. It affects GHES versions 3.17.0 through 3.22.0 (prior to the respective patch releases) and was disclosed on September 22, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, GHES 3.17 Release Notes).

The root cause is an incomplete URL validation in the GHES notebook viewer (CWE-918: Server-Side Request Forgery; CWE-208: Observable Timing Discrepancy). The viewer correctly checked the scheme and host of user-supplied URLs but omitted port validation, enabling an attacker to craft a notebook viewer URL with an explicit port number to reach internal services co-located on the appliance. Although response bodies were not returned to the requester, response timing differences acted as a side-channel oracle (CAPEC-462: Cross-Domain Search Timing), allowing an attacker to extract instance secrets character by character. Those extracted secrets could then be used in a separate interaction with an internal privileged service to achieve remote code execution (GitHub Advisory, GHES 3.19 Release Notes).

Successful exploitation results in full compromise of the GHES appliance — an attacker can extract sensitive instance secrets via timing analysis and subsequently use those secrets to execute arbitrary code remotely, achieving high confidentiality, integrity, and availability impact. When private mode is disabled, exploitation is entirely unauthenticated; when private mode is enabled, any authenticated user can exploit the flaw. The ability to execute code on the appliance could enable lateral movement to connected systems, exfiltration of source code and credentials, and persistent access to the enterprise development environment (GitHub Advisory, GHES 3.20 Release Notes).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability was reported through the GitHub Bug Bounty program. The EPSS score is approximately 0.89%, indicating a relatively low (but non-negligible) probability of exploitation in the near term. NVD SSVC assessment notes the vulnerability is automatable with total technical impact. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet- or network-accessible GitHub Enterprise Server instances running versions 3.17.0–3.22.0 (before the respective patches) using network scanning tools or Shodan. Determine whether private mode is enabled (unauthenticated access is possible if disabled).
2. Craft malicious notebook viewer URL: Construct a URL targeting the GHES notebook viewer endpoint that includes an explicit port number pointing to an internal service on the appliance (e.g., https://<ghes-host>/notebook-viewer?url=http://127.0.0.1:<internal_port>/...). The scheme and host validation passes, but the port is not rejected.
3. Perform timing-based secret extraction: Submit repeated requests with the crafted URL, varying the expected response content character by character. Measure response timing differences to determine whether each guessed character matches the actual secret value (timing oracle / CWE-208). Automate this process to extract the full secret iteratively.
4. Use extracted secret to interact with internal service: Leverage the recovered instance secret to authenticate to a privileged internal service on the appliance (e.g., an internal management API or privileged endpoint).
5. Achieve remote code execution: Use the authenticated internal service interaction to execute arbitrary commands on the GHES appliance, establishing a reverse shell or deploying a persistent backdoor (GitHub Advisory, GHES 3.21 Release Notes).

• Network: Unusual outbound or loopback HTTP requests from the GHES appliance to internal ports (e.g., 127.0.0.1 or localhost with non-standard ports) originating from the notebook viewer or Viewscreen service; high volume of repeated requests to the notebook viewer endpoint with varying URL parameters.
• Logs: GHES access logs showing repeated requests to the notebook viewer endpoint with URLs containing explicit port numbers (e.g., ?url=http://127.0.0.1:<port>/); anomalous timing patterns in notebook viewer request logs suggesting automated enumeration.
• Process: Unexpected child processes spawned by the GHES application or notebook/Viewscreen service (e.g., shell processes, curl, wget); unusual processes running under the GHES service account.
• File System: Unexpected scripts, web shells, or new cron jobs created on the appliance filesystem; modifications to GHES configuration files or internal service credentials.
• Authentication: Unexpected or anomalous authentication events against internal GHES management APIs or privileged internal services, particularly using tokens or secrets not associated with known administrative activity.

GitHub has released patched versions addressing CVE-2026-77987 across all affected branches: 3.17.21, 3.18.15, 3.19.12, 3.20.8, 3.21.6, and 3.22.1. The fix causes GHES to reject notebook viewer URLs that specify an explicit port. Administrators should upgrade to the appropriate patched version immediately. As an interim workaround if patching is not immediately possible, restrict network access to the GHES instance to trusted networks only, and enable private mode to require authentication for all access, reducing the unauthenticated attack surface (GHES 3.17 Release Notes, GHES 3.22 Release Notes).

The vulnerability received coverage from security news outlets including SecurityOnline and UnderCodeNews, which highlighted the critical nature of the SSRF-to-RCE chain (SecurityOnline, UnderCodeNews). The Centre for Cybersecurity Belgium (CCB) issued a warning advisory about the vulnerability (CCB Advisory). Community discussion was noted on Infosec.exchange, reflecting awareness among security practitioners of the severity of the timing-oracle-based secret extraction technique.