CVE-2026-76851 Overview
CVE-2026-76851 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in GitHub Enterprise Server (GHES) that enables remote code execution on the appliance. Insufficient network isolation allows a malicious pre-receive hook to impersonate an internal service and redirect trusted internal requests to a privileged service. This redirection results in elevated code execution on the GHES instance. Exploitation requires pre-receive hook networking to be enabled and either site administrator privileges or write access to a repository with a configured pre-receive hook. The issue was reported through the GitHub Bug Bounty program.
Critical Impact
An authenticated attacker with pre-receive hook access can achieve remote code execution on the GitHub Enterprise Server instance, compromising source code, secrets, and CI/CD integrations.
Affected Products
- GitHub Enterprise Server versions prior to 3.17.20
- GitHub Enterprise Server 3.18.x prior to 3.18.14, 3.19.x prior to 3.19.11, and 3.20.x prior to 3.20.7
- GitHub Enterprise Server 3.21.x prior to 3.21.5
Discovery Timeline
- 2026-09-01 - CVE-2026-76851 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-76851
Vulnerability Analysis
GitHub Enterprise Server supports pre-receive hooks, which are scripts executed on the server when users push to a repository. These hooks run in a sandboxed environment intended to be isolated from internal management services. The vulnerability stems from insufficient network isolation between the pre-receive hook execution environment and privileged internal services on the appliance. An attacker who controls hook code can craft outbound requests that impersonate an internal service. Trusted internal requests are then redirected to a privileged endpoint, which executes attacker-supplied logic with elevated privileges. The end result is arbitrary code execution on the GHES host.
Root Cause
The root cause is a network segmentation gap that permits pre-receive hook processes to communicate with internal service endpoints intended only for trusted appliance components. Combined with insufficient origin validation, this allows the hook to pose as an internal caller.
Attack Vector
Exploitation is network-based but requires prior access. The attacker must hold either site administrator privileges or write access to a repository that has a configured pre-receive hook. Pre-receive hook networking must be enabled on the instance. The attacker modifies or authors hook code to issue SSRF requests toward internal services, escalating to code execution on the appliance.
No verified public proof-of-concept is available. See the vendor release notes for technical remediation details.
Detection Methods for CVE-2026-76851
Indicators of Compromise
- Unexpected modifications to pre-receive hook scripts or repositories designated as hook sources.
- Outbound HTTP or HTTPS requests from the pre-receive hook sandbox targeting internal management endpoints or loopback services.
- New or unusual processes spawned by the hook runner outside of expected git execution paths.
- Creation of new site administrator accounts or unauthorized changes to admin group membership on the GHES instance.
Detection Strategies
- Review audit logs for pre-receive hook configuration changes, hook environment toggles, and repository permission grants.
- Correlate git push events with subsequent internal network connections initiated by the hook execution context.
- Alert on privileged commands or shell invocations tied to the pre-receive hook process tree.
- Baseline normal hook egress destinations and flag deviations to internal service addresses.
Monitoring Recommendations
- Ingest GHES audit and system logs into a centralized SIEM for correlation across push, hook execution, and administrative events.
- Monitor administrative API calls and session activity for accounts with site administrator or repository write privileges.
- Track appliance-level process telemetry to identify anomalous child processes of the pre-receive hook runner.
How to Mitigate CVE-2026-76851
Immediate Actions Required
- Upgrade GitHub Enterprise Server to 3.17.20, 3.18.14, 3.19.11, 3.20.7, 3.21.5, or later on the applicable release track.
- Audit accounts that hold site administrator privileges and repository write access to repositories with configured pre-receive hooks.
- Review all existing pre-receive hooks for unauthorized or suspicious modifications prior to patching.
- Rotate credentials, tokens, and deploy keys stored on the appliance if compromise is suspected.
Patch Information
GitHub released fixes in GHES 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. All versions prior to 3.22 are affected and should be updated to a patched release. Refer to the vendor release notes: GHES 3.17.20, GHES 3.18.14, GHES 3.19.11, GHES 3.20.7, and GHES 3.21.5.
Workarounds
- Disable pre-receive hook networking in the GHES Management Console until patches are applied.
- Restrict write access to repositories that contain configured pre-receive hooks to a minimal, trusted user set.
- Limit site administrator role assignments and enforce multi-factor authentication for all privileged accounts.
- Segment the GHES appliance network to constrain lateral movement from the hook sandbox to internal services.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
