CVE-2026-8606

Vulnerability

A Server-Side Request Forgery (SSRF) vulnerability exists in the security advisories package lookup feature of GitHub Enterprise Server. The package URL endpoint did not validate the supplied package name, enabling SSRF to internal services. This affects all versions prior to 3.21.1, with fixes in 3.20.3, 3.19.7, 3.18.10, 3.17.16, and 3.16.19 [1][2][3][4]. Exploitation requires GitHub Packages to be enabled. On instances not running in private mode, the vulnerability is exploitable without authentication; otherwise, any authenticated user can exploit it.

Exploitation

An attacker can send a crafted request to the security advisories package lookup endpoint, specifying a malicious package name that causes the server to issue an HTTP request to an internal management service. By measuring the response timing of these requests, the attacker can infer the values of sensitive environment variables, including signing secrets and private keys.

Impact

Successful exploitation allows an attacker to extract sensitive environment variables containing signing secrets and private keys. This information disclosure could lead to further compromise of the GitHub Enterprise Server instance and its data.

Mitigation

The vulnerability is fixed in GitHub Enterprise Server versions 3.20.3, 3.19.7, 3.18.10, 3.17.16, and 3.16.19 [1][2][3][4]. The affected endpoint has been removed from the server. Administrators should upgrade to one of these versions or later. There are no known workarounds.