Cross-Site Request Forgery Vulnerability in GitHub Enterprise Server

CVE-2026-110288

What is CVE-2026-110288?

A cross-site request forgery vulnerability in GitHub Enterprise Server allows an unauthenticated attacker to potentially delete important Slack and Microsoft Teams ChatOps configurations and credentials. This exploitation occurs when an authenticated Management Console operator unwittingly visits an attacker-controlled site, prompting their browser to send a malicious request to the integration removal endpoint without a necessary CSRF token. If successfully executed, the attacker can disrupt ChatOps notifications and commands that rely on these configurations. The vulnerability impacts all versions of GitHub Enterprise Server prior to 3.23 and has been addressed in subsequent updates, including versions 3.19.14, 3.20.10, 3.21.8, and 3.22.3, as noted in GitHub's release notes and reported through their Bug Bounty program.

References