Server-Side Request Forgery Vulnerability in GitHub Enterprise Server

CVE-2026-8034

What is CVE-2026-8034?

A server-side request forgery (SSRF) vulnerability has been discovered in GitHub Enterprise Server's notebook viewer, enabling potential attackers to access internal services. The issue arises from a discrepancy between the validation layer and the HTTP request library, resulting in hostname validation utilizing a distinct URL parser. Consequently, an attacker can manipulate a crafted URL to bypass validation and redirect the request to an unintended internal host. Exploitation of this vulnerability requires network access to the affected GitHub Enterprise Server instance. This flaw impacts all versions prior to 3.21 but has been resolved in later releases.

References