CVE-2026-8606: GitHub Enterprise Server SSRF Vulnerability

CVE-2026-8606 Overview

CVE-2026-8606 is a Server-Side Request Forgery (SSRF) vulnerability in GitHub Enterprise Server (GHES). The flaw resides in the security advisories package lookup feature, which can be abused to force the server to issue arbitrary HTTP requests against internal services. By directing requests to an internal management service and measuring response timing, an attacker can infer values of sensitive environment variables, including signing secrets and private keys. Exploitation requires GitHub Packages to be enabled. On instances not running in private mode, the vulnerability is exploitable without authentication; otherwise, any authenticated user can exploit it. The issue is tracked under [CWE-918] and was reported via the GitHub Bug Bounty program.

Critical Impact

An unauthenticated or low-privileged attacker can extract signing secrets and private keys from internal services via timing-based SSRF inference.

Affected Products

• GitHub Enterprise Server versions prior to 3.21.1
• GitHub Enterprise Server 3.16.x, 3.17.x, 3.18.x, 3.19.x, 3.20.x release branches
• Instances with GitHub Packages enabled (unauthenticated when not in private mode)

Discovery Timeline

• 2026-05-27 - CVE-2026-8606 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-8606

Vulnerability Analysis

The vulnerability stems from improper validation of URLs processed by the security advisories package lookup feature in GHES. The feature accepts attacker-influenced input and dispatches HTTP requests on behalf of the server. Because outbound requests originate from the GHES host itself, they reach internal management endpoints that are not exposed externally.

Attackers cannot directly read the HTTP response bodies of these internal calls. Instead, they measure response timing differences to infer sensitive data character-by-character. This timing oracle exposes environment variables containing signing secrets and private keys, which can be used to forge tokens or compromise package integrity.

The issue is classified under [CWE-918] (Server-Side Request Forgery). The severity reflects high confidentiality impact on subsequent systems reached via the SSRF primitive, even though the vulnerable component itself only leaks limited data per request.

Root Cause

The package lookup handler does not enforce a strict allowlist for downstream request targets. Requests destined for the security advisories feature can be redirected to internal hostnames or loopback addresses. Combined with measurable timing variations in the internal management service, this produces a side-channel that leaks secret material.

Attack Vector

The attack is network-based and requires GitHub Packages to be enabled on the target GHES instance. On instances not configured in private mode, no authentication is required. On private-mode instances, any authenticated user can trigger exploitation. The attacker issues crafted lookup requests to the security advisories endpoint, encoding guesses for secret bytes into requests directed at the internal management service. Response latency reveals correct guesses, allowing iterative extraction of signing secrets and private keys.

No public proof-of-concept or in-the-wild exploitation has been reported. See the GitHub Enterprise 3.21.1 release notes for vendor details.

Detection Methods for CVE-2026-8606

Indicators of Compromise

• High volumes of requests to the security advisories package lookup endpoint from a single source IP or user account
• Outbound HTTP requests from GHES application processes to internal management service hostnames or loopback addresses
• Repeated requests with small variations in package identifier parameters, consistent with byte-by-byte inference
• Latency-sensitive request patterns showing consistent timing measurement attempts

Detection Strategies

• Inspect GHES nginx and application logs for repetitive requests to security advisory and package lookup routes from the same client
• Correlate inbound API requests with outbound internal HTTP calls originating from GHES service processes
• Baseline normal package lookup volume per user and alert on statistical anomalies
• Hunt for unauthenticated access to the affected endpoints on instances where GitHub Packages is enabled

Monitoring Recommendations

• Forward GHES audit logs, web server logs, and host network telemetry to a centralized analytics platform
• Enable network flow monitoring on the GHES management network segment to identify unexpected loopback or internal targets
• Track environment variable and secret rotation events to confirm rapid response if exposure is suspected
• Alert on access patterns matching SSRF timing-oracle behavior, such as identical requests with measured delays

How to Mitigate CVE-2026-8606

Immediate Actions Required

• Upgrade GHES to a fixed version: 3.21.1, 3.20.3, 3.19.7, 3.18.10, 3.17.16, or 3.16.19
• Rotate any signing secrets, private keys, and tokens stored in GHES environment variables that may have been exposed
• If patching is not immediately possible, disable GitHub Packages on the instance to remove the exploitation prerequisite
• Review web server and audit logs for prior abuse of the security advisories package lookup endpoint

Patch Information

GitHub fixed the vulnerability in GHES versions 3.21.1, 3.20.3, 3.19.7, 3.18.10, 3.17.16, and 3.16.19. Administrators should consult the relevant release notes: 3.16.19, 3.17.16, 3.18.10, 3.19.7, 3.20.3, and 3.21.1.

Workarounds

• Disable GitHub Packages on the GHES instance until the upgrade is complete
• Enforce private mode so that exploitation requires authentication, reducing the unauthenticated attack surface
• Restrict network access to the GHES administrative interfaces using upstream firewall rules
• Apply egress filtering to prevent GHES application processes from reaching unintended internal services

# Configuration example: disable GitHub Packages via the GHES admin shell
ghe-config app.packages.enabled false
ghe-config-apply