Skip to content
OpenAdvisories
High WID-SEC-2026-1432 4 CVEs

Microsoft GitHub Enterprise: Mehrere Schwachstellen

Published May 7, 2026 · Updated May 7, 2026 · de-DE

Vendor: Microsoft Product: GitHub Enterprise

Summary

Ein Angreifer kann mehrere Schwachstellen in Microsoft GitHub Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, und um Informationen offenzulegen.

Product

GitHub ist ein netzbasierter Dienst zur Versionsverwaltung für Software-Entwicklungsprojekte.

Vulnerabilities 4

  • High 7.9
    CVE-2026-8034

    Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion

    A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusion between the validation layer and the HTTP request library…

    GitHub Enterprise Server
  • Medium 6.3
    CVE-2026-6736

    Authentication bypass vulnerability in GitHub Enterprise Server allowed creation of local user accounts bypassing the configured external identity provider

    An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to create a local user account, bypassing the configured external identity provider. When external authentication was enabled, the signu…

    GitHub Enterprise Server
  • Medium 6.3
    CVE-2026-7541

    Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint

    A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint par…

    GitHub Enterprise Server
  • Medium 5.9
    CVE-2026-8106

    Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft

    A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page that could allow credential theft. The redirect_to query parameter on the /setup/unlock endpoint was reflected into an HTML attribute without…

    GitHub Enterprise Server

Revision history

  1. #1

    Initiale Fassung

References