Skip to content
OpenAdvisories
High WID-SEC-2026-3151 3 CVEs

Microsoft GitHub Enterprise Server: Mehrere Schwachstellen

Published Sep 1, 2026 · Updated Sep 1, 2026 · de-DE

Vendor: Microsoft Product: GitHub Enterprise

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Microsoft GitHub Enterprise Server ausnutzen, um Informationen offenzulegen oder beliebigen Code auszuführen.

Product

GitHub ist ein netzbasierter Dienst zur Versionsverwaltung für Software-Entwicklungsprojekte.

Vulnerabilities 3

  • High 8.2
    CVE-2026-18730

    Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token

    A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed…

    GitHub Enterprise Server
  • High 7.7
    CVE-2026-19118

    Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution

    A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload reque…

    GitHub Enterprise Server
  • High 7.7
    CVE-2026-76851

    Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services

    A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and red…

    GitHub Enterprise Server

Revision history

  1. #1

    Initiale Fassung

References