CVE-2026-18730 Overview
CVE-2026-18730 is a Server-Side Request Forgery (SSRF) vulnerability in GitHub Enterprise Server (GHES). An unauthenticated attacker can coerce the Manage API into issuing crafted outbound requests to an attacker-controlled host. The flaw resides in an unauthenticated endpoint that parses attacker-supplied cluster configuration and issues gateway-to-agent requests. The HMAC used to authenticate those requests covers only a timestamp, not the request path or body. An attacker positioned to intercept the outbound request can capture this token and replay it against privileged management agent endpoints. The issue is tracked as CWE-918 and was reported through the GitHub Bug Bounty program.
Critical Impact
Unauthenticated attackers can replay captured HMAC tokens against privileged management agent endpoints, exposing sensitive administrative functionality on non-HA GHES deployments.
Affected Products
- GitHub Enterprise Server versions prior to 3.17.19
- GitHub Enterprise Server versions prior to 3.18.13, 3.19.10, and 3.20.6
- GitHub Enterprise Server versions prior to 3.21.4 (all releases before 3.22)
Discovery Timeline
- 2026-09-01 - CVE-2026-18730 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-18730
Vulnerability Analysis
The vulnerability exists in the GHES Manage API, which exposes an unauthenticated endpoint that accepts cluster configuration input. When this endpoint processes attacker-supplied configuration, it triggers gateway-to-agent HTTP requests to hosts specified within that configuration. Because the endpoint does not require authentication, any network-reachable attacker can force GHES to issue outbound requests to arbitrary destinations.
The outbound requests carry an HMAC token intended to authenticate the gateway to management agents. However, the HMAC is computed only over a timestamp value. It does not bind the request path, method, headers, or body. An attacker who receives the SSRF callback captures this HMAC and reuses it to sign arbitrary requests directed at privileged agent endpoints, converting the SSRF into an authenticated abuse of internal management APIs.
High-availability (HA) deployments are not impacted because a topology restriction blocks the exploitable request path in that configuration.
Root Cause
The root cause is twofold. First, an unauthenticated Manage API endpoint parses caller-controlled cluster configuration and initiates outbound requests based on it, satisfying the classic SSRF pattern classified under CWE-918. Second, the HMAC scheme used for gateway-to-agent authentication only covers a timestamp, so tokens are not bound to specific requests and can be replayed.
Attack Vector
Exploitation requires network access to the GHES appliance and the ability to receive the coerced outbound request. The attacker submits crafted cluster configuration to the unauthenticated endpoint, points the outbound target at their own host, captures the HMAC-authenticated request, and replays the token against management agent endpoints with attacker-chosen paths and bodies. No user interaction and no prior credentials are required. Refer to the vendor advisories linked in the Patch Information section for the vulnerable code paths.
Detection Methods for CVE-2026-18730
Indicators of Compromise
- Outbound HTTP requests from the GHES Manage API or gateway process to unexpected external or internal hosts not part of the documented topology.
- Requests to the Manage API cluster configuration endpoint from unauthenticated sources or unusual client IPs.
- Repeated requests to management agent endpoints carrying HMAC headers with identical or closely spaced timestamp values (replay indicators).
Detection Strategies
- Inspect GHES manage-api and gateway logs for unauthenticated requests that supply cluster configuration payloads referencing external hostnames or non-loopback IPs.
- Alert on management agent endpoints receiving requests where the HMAC timestamp is reused across different request paths or bodies.
- Correlate egress netflow from the GHES appliance against an allowlist of expected internal cluster peers.
Monitoring Recommendations
- Enable and forward GHES audit and system logs to a centralized SIEM for retention and correlation.
- Restrict and monitor outbound network paths from GHES to only documented cluster and update endpoints.
- Baseline normal Manage API traffic and alert on new source IPs, new user agents, or unauthenticated calls to configuration endpoints.
How to Mitigate CVE-2026-18730
Immediate Actions Required
- Upgrade GHES to a fixed release: 3.17.19, 3.18.13, 3.19.10, 3.20.6, or 3.21.4.
- Restrict network access to the GHES Manage API so that only trusted administrative networks can reach it.
- Review recent Manage API and gateway logs for evidence of unauthenticated cluster configuration submissions or unexpected outbound requests.
Patch Information
GitHub fixed this vulnerability in GHES 3.17.19, 3.18.13, 3.19.10, 3.20.6, and 3.21.4. All releases prior to 3.22 are affected in the absence of these patches. Consult the vendor release notes for details: GitHub Release Notes 3.17.19, GitHub Release Notes 3.18.13, GitHub Release Notes 3.19.10, GitHub Release Notes 3.20.6, and GitHub Release Notes 3.21.4.
Workarounds
- Deploy GHES in a high-availability topology, which the vendor confirms is not affected due to a topology restriction on the vulnerable request path.
- Place the Manage API behind a segmentation boundary that blocks untrusted sources from reaching the unauthenticated endpoint.
- Enforce strict egress filtering on the GHES appliance so it cannot initiate outbound HTTP requests to attacker-controlled destinations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
