CVE-2026-77987 Overview
A server-side request forgery (SSRF) vulnerability affects the notebook viewer component of GitHub Enterprise Server. The notebook viewer validated the scheme and host of user-supplied URLs but failed to validate the port. Attackers could redirect requests to internal services listening on other ports of the same appliance. Response bodies were not returned, but response timing acted as an oracle to extract instance secrets character by character. An extracted secret enabled a separate interaction with an internal service to obtain remote code execution on the appliance. The flaw was reported through the GitHub Bug Bounty program and is tracked under [CWE-208] (Observable Timing Discrepancy).
Critical Impact
Unauthenticated network attackers can extract instance secrets via timing side-channel and chain them to achieve remote code execution on the appliance when private mode is disabled.
Affected Products
- GitHub Enterprise Server 3.17.x through 3.17.20
- GitHub Enterprise Server 3.18.x through 3.18.14, 3.19.x through 3.19.11, 3.20.x through 3.20.7
- GitHub Enterprise Server 3.21.x through 3.21.5 and 3.22.0
Discovery Timeline
- 2026-09-22 - CVE CVE-2026-77987 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-77987
Vulnerability Analysis
The notebook viewer accepts a user-supplied URL to render notebook content. Its allow-list logic checked the URL scheme and hostname but omitted the port component. An attacker could specify an authorized host paired with an arbitrary internal port, causing the appliance to issue outbound requests to co-located internal services. This class of SSRF bypasses host-based controls by exploiting incomplete URL parsing and validation.
Although the notebook viewer did not return response bodies to the requester, the time taken to process each request depended on the content of internal responses. This observable timing discrepancy [CWE-208] created an oracle that leaked information one character at a time. By issuing repeated crafted requests and measuring latency, an attacker could reconstruct sensitive instance secrets.
Root Cause
The root cause is incomplete URL validation combined with information disclosure through timing. The scheme and host checks did not compose a full authority check, so the port field was uncontrolled. Compounding this, downstream request handling exhibited data-dependent timing behavior, converting a blind SSRF into a practical secret-extraction primitive.
Attack Vector
Exploitation requires network access to the GitHub Enterprise Server instance. When private mode is disabled the vulnerability is unauthenticated. When private mode is enabled, any authenticated user can trigger the flaw. The attacker submits crafted notebook URLs that point to internal listeners on non-standard ports, measures response timings to reconstruct a secret byte-by-byte, then replays the extracted secret against an internal service to achieve remote code execution on the appliance.
No public proof-of-concept code has been released for this issue. Refer to the vendor release notes for technical remediation details.
Detection Methods for CVE-2026-77987
Indicators of Compromise
- High-volume, repetitive requests to the notebook viewer endpoint from a single client with near-identical URL structures differing only by a query or path byte.
- Outbound HTTP requests originating from the appliance to loopback or internal addresses on non-standard TCP ports.
- Unusual authentication or configuration retrieval activity from internal services immediately after clusters of notebook viewer requests.
Detection Strategies
- Inspect application and reverse-proxy logs for notebook viewer requests containing URLs with atypical port specifications targeting internal services.
- Correlate spikes in notebook viewer traffic with subsequent privileged actions on the appliance to identify secret replay attempts.
- Baseline normal notebook viewer request rates per source IP and alert on statistical outliers indicative of timing-oracle probing.
Monitoring Recommendations
- Enable verbose access logging on the notebook viewer service and forward logs to a centralized analytics platform.
- Monitor appliance-local network sockets for unexpected connections to management or metadata ports.
- Alert on repeated 4xx or 5xx responses from internal services that follow bursts of notebook viewer activity.
How to Mitigate CVE-2026-77987
Immediate Actions Required
- Upgrade to a fixed GitHub Enterprise Server release: 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, or 3.17.21.
- Restrict network access to the GitHub Enterprise Server management interface to trusted administrative networks until the patch is applied.
- Rotate instance secrets, deploy keys, and administrative credentials after upgrading if exposure is suspected.
Patch Information
GitHub released fixes across all supported branches. See the vendor release notes for GitHub Enterprise Server 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21.
Workarounds
- Enable private mode to require authentication for all requests, reducing the unauthenticated attack surface until patching is complete.
- Segment the appliance so that internal management services are unreachable from the notebook viewer request path where feasible.
- Apply network egress filtering on the appliance to block outbound requests to loopback and internal addresses initiated by the notebook viewer process.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
