← Back to CVE Explorer

CVE-2026-5921

Full vulnerability record from the local CVENow database.

Description

A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to extract sensitive environment variables from the instance through a timing side-channel attack against the notebook rendering service. When private mode was disabled, the notebook viewer followed HTTP redirects without revalidating the destination host, enabling an unauthenticated SSRF to internal services. By chaining this with regex filter queries against an internal API and measuring response time differences, an attacker could infer secret values character by character. Exploitation required that private mode be disabled and that the attacker be able to chain the instance's open redirect endpoint through an external redirect to reach internal services. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.14.26, 3.15.21, 3.16.17, 3.17.14, 3.18.8, 3.19.5, and 3.20.1. This vulnerability was reported via the GitHub Bug Bounty program.

Severity
HIGH
CVSS score
8.9 (v4.0)
Vulnerability status
Analyzed
Source identifier
[email protected]
Published
2026-04-21 23:16:22.667000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON 
{
  "id": "CVE-2026-5921",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-21T23:16:22.667",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to extract sensitive environment variables from the instance through a timing side-channel attack against the notebook rendering service. When private mode was disabled, the notebook viewer followed HTTP redirects without revalidating the destination host, enabling an unauthenticated SSRF to internal services. By chaining this with regex filter queries against an internal API and measuring response time differences, an attacker could infer secret values character by character. Exploitation required that private mode be disabled and that the attacker be able to chain the instance's open redirect endpoint through an external redirect to reach internal services. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.14.26, 3.15.21, 3.16.17, 3.17.14, 3.18.8, 3.19.5, and 3.20.1. This vulnerability was reported via the GitHub Bug Bounty program."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) fue identificada en GitHub Enterprise Server que permitió a un atacante extraer variables de entorno sensibles de la instancia a través de un ataque de canal lateral de temporización contra el servicio de renderizado de cuadernos. Cuando el modo privado estaba deshabilitado, el visor de cuadernos seguía redirecciones HTTP sin revalidar el host de destino, lo que permitía una SSRF no autenticada a servicios internos. Al encadenar esto con consultas de filtro regex contra una API interna y midiendo las diferencias en el tiempo de respuesta, un atacante podía inferir valores secretos carácter por carácter. La explotación requería que el modo privado estuviera deshabilitado y que el atacante pudiera encadenar el endpoint de redirección abierta de la instancia a través de una redirección externa para alcanzar servicios internos. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server anteriores a la 3.21 y fue corregida en las versiones 3.14.26, 3.15.21, 3.16.17, 3.17.14, 3.18.8, 3.19.5 y 3.20.1. Esta vulnerabilidad fue reportada a través del programa GitHub Bug Bounty."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "GitHub",
          "product": "Enterprise Server",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "3.14.0",
              "lessThan": "3.14.26",
              "versionType": "semver",
              "status": "affected",
              "changes": [
                {
                  "at": "3.14.26",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "3.15.0",
              "lessThan": "3.15.21",
              "versionType": "semver",
              "status": "affected",
              "changes": [
                {
                  "at": "3.15.21",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "3.16.0",
              "lessThan": "3.16.17",
              "versionType": "semver",
              "status": "affected",
              "changes": [
                {
                  "at": "3.16.17",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "3.17.0",
              "lessThan": "3.17.14",
              "versionType": "semver",
              "status": "affected",
              "changes": [
                {
                  "at": "3.17.14",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "3.18.0",
              "lessThan": "3.18.8",
              "versionType": "semver",
              "status": "affected",
              "changes": [
                {
                  "at": "3.18.8",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "3.19.0",
              "lessThan": "3.19.5",
              "versionType": "semver",
              "status": "affected",
              "changes": [
                {
                  "at": "3.19.5",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "3.20.0",
              "lessThan": "3.20.1",
              "versionType": "semver",
              "status": "affected",
              "changes": [
                {
                  "at": "3.20.1",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.9,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "LOW",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
          "baseScore": 8.9,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-22T13:17:53.690876Z",
          "id": "CVE-2026-5921",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "3.14.26",
              "matchCriteriaId": "72A92258-9FCC-41E0-856B-3C2A495575A6"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.15.0",
              "versionEndExcluding": "3.15.21",
              "matchCriteriaId": "3A14A459-881C-437A-88EC-D721E3005329"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.16.0",
              "versionEndExcluding": "3.16.17",
              "matchCriteriaId": "8B7DCD9A-2CF0-4D96-AA96-ACEC662A8E1F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.17.0",
              "versionEndExcluding": "3.17.14",
              "matchCriteriaId": "CEC2ADE6-3E31-4889-9A73-B6695FE0AB52"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.18.0",
              "versionEndExcluding": "3.18.8",
              "matchCriteriaId": "9B15B12E-00A8-48E8-81DE-54506B94A2C5"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.19.0",
              "versionEndExcluding": "3.19.5",
              "matchCriteriaId": "56903EAF-4579-4263-AB0F-863323E7C81A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:github:enterprise_server:3.20.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DCA4F97D-688E-45D2-90C0-8A11E9B531AA"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.14.26",
      "source": "[email protected]",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.15.21",
      "source": "[email protected]",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.16.17",
      "source": "[email protected]",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.17.14",
      "source": "[email protected]",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.18.8",
      "source": "[email protected]",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.19.5",
      "source": "[email protected]",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.20.1",
      "source": "[email protected]",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ]
    }
  ]
}