CVE-2026-9106 Overview
CVE-2026-9106 is a user interface (UI) misrepresentation vulnerability [CWE-451] affecting GitHub Enterprise Server. The flaw allows an OAuth application to gain unintended access to an organization's runner management. An attacker crafts an OAuth application that requests the manage_runners:org scope, then directs a victim user to authorize it. The authorization consent screen fails to display the manage_runners:org scope, so the victim approves permissions they never see.
The issue affects all versions of GitHub Enterprise Server prior to 3.22 and was reported through the GitHub Bug Bounty program. Patches ship in 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, and 3.16.20.
Critical Impact
Authorized OAuth applications can silently obtain organization runner management privileges, enabling manipulation of self-hosted CI/CD runners without the victim's informed consent.
Affected Products
- GitHub Enterprise Server versions prior to 3.16.20
- GitHub Enterprise Server 3.17.x prior to 3.17.17, 3.18.x prior to 3.18.11, 3.19.x prior to 3.19.8
- GitHub Enterprise Server 3.20.x prior to 3.20.4 and 3.21.x prior to 3.21.2
Discovery Timeline
- 2026-06-30 - CVE-2026-9106 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-9106
Vulnerability Analysis
GitHub Enterprise Server presents an OAuth consent screen when a user authorizes a third-party application. The consent screen enumerates the scopes the application is requesting so the user can make an informed decision. In vulnerable versions, the manage_runners:org scope is omitted from this enumeration.
A user who intends to grant a limited scope such as read:user receives no warning that the same authorization also grants control over the organization's self-hosted runners. Runner management includes registering, removing, and configuring runners that execute GitHub Actions workflows, which are frequently used to build production artifacts and hold access to secrets.
Root Cause
The defect is a UI misrepresentation classified under [CWE-451]. The scope-to-label mapping used by the consent view does not include an entry for manage_runners:org. The backend still honors the scope during token issuance, so a mismatch exists between what the user consents to and what the resulting OAuth token can do.
Attack Vector
Exploitation requires an attacker to register an OAuth application on the target GitHub Enterprise Server and social-engineer a victim with organization-level privileges to authorize it. The attack is network-based, low complexity, and requires user interaction. Once the victim authorizes the application, the attacker obtains a token with runner management authority and can perform actions such as registering rogue self-hosted runners or removing legitimate ones.
Because no verified public exploit code is available, defenders should reference the GitHub Enterprise release notes for 3.21.2 for the authoritative technical description.
Detection Methods for CVE-2026-9106
Indicators of Compromise
- OAuth application authorizations that include the manage_runners:org scope but were granted prior to patching
- Unexpected self-hosted runner registrations or deregistrations in organization audit logs
- New OAuth applications created by non-administrative users shortly before an authorization event
Detection Strategies
- Review the organization's third-party OAuth application list and enumerate granted scopes, focusing on manage_runners:org
- Correlate oauth_authorization.create audit events with subsequent actions_runner.register or actions_runner.remove events
- Alert on any OAuth token that exercises runner management API endpoints without prior administrative approval
Monitoring Recommendations
- Ingest GitHub Enterprise Server audit logs into a centralized logging platform and retain them for at least 90 days
- Establish a baseline of expected OAuth applications and generate alerts on new authorizations that carry organization-wide scopes
- Monitor CI/CD workflow runs for jobs picked up by newly registered, unfamiliar self-hosted runners
How to Mitigate CVE-2026-9106
Immediate Actions Required
- Upgrade GitHub Enterprise Server to 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, or 3.16.20 depending on your release train
- Audit all existing OAuth application authorizations and revoke any that hold manage_runners:org without a documented business justification
- Rotate self-hosted runner registration tokens after patching to invalidate any tokens obtained via the flaw
Patch Information
GitHub has released fixes in the following versions: 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, and 3.16.20. Administrators should apply the patch matching their current major-minor version.
Workarounds
- Restrict OAuth application authorization to a pre-approved allowlist using the organization's OAuth app access policy until patching completes
- Require organization owner approval for any OAuth application requesting organization-level scopes
- Temporarily disable self-hosted runners at the organization level if runner management cannot be monitored during the patch window
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
