Server-Side Request Forgery in GitHub Enterprise Server's Notebook Viewer

CVE-2026-77987

What is CVE-2026-77987?

A server-side request forgery (SSRF) vulnerability exists in the notebook viewer of GitHub Enterprise Server that permits attackers to manipulate requests to the server. The viewer appropriately checks the scheme and host of URLs provided by users but fails to validate the port. This oversight enables unauthorized requests to internal services operating on different ports within the same appliance. While response bodies are not sent back to the requester, the timing of responses can leak information character by character, facilitating the extraction of instance secrets. Such secrets may subsequently be employed in other operations, potentially leading to remote code execution vulnerabilities. Exploitation of this issue necessitates network access to the GitHub instance; it remains unauthenticated if private mode is inactive or requires authentication when the private mode is active. This issue was uncovered through GitHub's Bug Bounty program and affects versions 3.17 through 3.22, which have been patched in subsequent updates.

References