This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] GitHub Enterprise Server fixes 6 vulnerabilities

GitHub fixes 6 vulnerabilities in GitHub Enterprise Server with versions 3.21, 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21 and 3.14.26 [1][2][3][4][5][6].

GitHub Enterprise Server - improper authorization (CVE-2026-5845)
CVSS 7.2 (High)

An authenticated local attacker is able, within the user token authorization mechanism, to gain unauthorized access to private repositories, including the ability to write to them beyond the assigned privileges [1].

The vulnerability is present in product:

  • GitHub Enterprise Server; >=3.20.0, < 3.20.1; >=3.19.0, <3.19.5; >=3.18.0, <3.18.8; >=3.17.0, <3.17.14; >=3.16.0, <3.16.17; >=3.15.0, <3.15.21; >=3.14.0, <3.14.26

CVSS: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

More information:

The vulnerability was publicly disclosed 21. 4. 2026.

GitHub Enterprise Server - SSRF (CVE-2026-5921)
CVSS 8.9 (High)

An unauthenticated remote attacker is able, when private mode is disabled, to carry out an SSRF attack combined with a side-channel timing attack and to extract sensitive environment variables from the instance's internal services without authorization [2].

The vulnerability is present in product:

  • GitHub Enterprise Server; >= 3.14.0, < 3.14.26; >= 3.15.0, < 3.15.21; >= 3.16.0, < 3.16.17; >= 3.17.0, < 3.17.14; >= 3.18.0, < 3.18.8; >= 3.19.0, < 3.19.5; >= 3.20.0, < 3.20.1

CVSS: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:P

More information:

The vulnerability was publicly disclosed 21. 4. 2026.

GitHub Enterprise Server - command injection (CVE-2026-4821)
CVSS 8.1 (High)

An authenticated local attacker with Management Console administrator privileges is able to execute arbitrary commands in the server operating system by injecting special shell metacharacters into the proxy configuration fields [3].

The vulnerability is present in product:

  • GitHub Enterprise Server; >= 3.14.0, < 3.14.26; >= 3.15.0, < 3.15.21; >= 3.16.0, < 3.16.17; >= 3.17.0, < 3.17.14; >= 3.18.0, < 3.18.8; >= 3.19.0, < 3.19.5; >= 3.20.0, < 3.20.1

CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

More information:

  • CVE-2026-4821 at cve.org, NVD
  • CWE-78: Improper neutralization of special elements used in an OS command ('OS command injection') at cwe.mitre.org

The vulnerability was publicly disclosed 21. 4. 2026.

By CESNET, z.s.p.o. Henrieta Paločková on 7. 5. 2026.

CESNET, z.s.p.o. Logo