home / blog
2026-05-27 · high
GitHub Enterprise Server: unauthenticated SSRF (CVE-2026-9312)
Unauthenticated SSRF in GitHub Enterprise Server: internal services reachable. High per NVD (8.2), critical per GitHub (9.2).
On 27 May 2026 the record for CVE-2026-9312 was published, an unauthenticated server-side request forgery in GitHub Enterprise Server. Through an upload endpoint with weak validation, an attacker can make the server send requests to internal services.
The severity is rated differently: NVD assigns CVSS v3.1 8.2 (high), while the GitHub CNA assigns CVSS v4.0 9.2 (critical). This article reports both values without choosing one.
Update to the fixed release for your branch: 3.17.17, 3.18.11, 3.19.8, 3.20.4 or 3.21.2. For instances on 3.22, see the release notes. Also make sure the instance's network segment cannot reach sensitive internal databases or services.
At a glance
- What
- An unauthenticated attacker can reach internal instance services through an upload endpoint, due to weak input validation.
- Severity
- CVSS v3.1 8.2 (high) according to NVD; CVSS v4.0 9.2 (critical) according to the GitHub CNA.
- Affected versions
- GitHub Enterprise Server before 3.22.
- Fix
- GHES 3.17.17, 3.18.11, 3.19.8, 3.20.4 and 3.21.2. For 3.22 see the release notes.
- Action
- Update to the fixed release for your branch. Make sure internal services are not reachable from the instance's network segment.
Sources: NVD, CVE-2026-9312 · GitHub, note di rilascio GHES 3.21.2