Server-Side Request Forgery Vulnerability in GitHub Enterprise Server

CVE-2026-5921

What is CVE-2026-5921?

A server-side request forgery (SSRF) vulnerability was discovered in GitHub Enterprise Server, enabling attackers to exploit a flaw within the notebook rendering service. When private mode is disabled, the service fails to validate HTTP redirects, hence allowing unauthenticated access to internal services. By leveraging timing side-channel attacks and regex filters against internal APIs, attackers can deduce sensitive information character by character based on response time disparities. This issue affects all GitHub Enterprise Server versions earlier than 3.21 and poses significant risks if private mode is compromised.

References