CVE-2026-18730Disclosure(github / enterprise_server)

LOWCVSS 7.4 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch github enterprise_server systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster configuration and issued gateway-to-agent requests whose HMAC authenticated only a timestamp, not the request path or body. An attacker positioned to intercept the outbound request could capture this token and replay it against privileged management agent endpoints. High-availability deployments were not affected due to a topology restriction. This vulnerability affected GitHub Enterprise Server releases in the 3.17, 3.18, 3.19, 3.20, and 3.21 series and was fixed in versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6. This vulnerability was reported via the GitHub Bug Bounty program.

github CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

enterprise_server

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-09-02); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

github

Products

enterprise_server

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

sy.br1d@sybr1d_46d
Disclosure
Eu havia reportado uma cadeia de RCE no Github que hj a causa raiz dela foi corrigida a partir do report original https://www.cve.org/cverecord?id=CVE-2026-18730 Porem, aparentemente não chegaram no impacto de RCE do meu report. Dito isso, daqui um tempo eu publico o writeup/poc da minha chain que levava ao atacante conseguir adicionar chaves SSH de admin e tomar o controle da instancia
Post summary
The author reports that CVE-2026-18730 is a chain of RCE in GitHub, notes that its root cause has been patched, but the RCE impact was not realized, and they plan to publish a writeup and PoC later.
1203322.5K
1.7K followersView on X
CVE@CVEnew44d
Disclosure
CVE-2026-18730 A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send… https://www.cve.org/CVERecord?id=CVE-2026-18730
Post summary
The statement announces a new SSRF vulnerability (CVE‑2026‑18730) in GitHub Enterprise Server that enables unauthenticated attackers to force the Manage API to send requests; no PoC, exploit tool, or mitigation is mentioned.
00000985
58.1K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	github	enterprise_server	-	-	-

Explore more

Back to dashboard github CVEs enterprise_server vulnerabilities