CVE-2026-96890

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.20 through 3.20.8 GitHub Enterprise Server versions 3.21 through 3.21.6 GitHub Enterprise Server versions 3.22 through 3.22.1

Description A Server-Side Request Forgery (SSRF) issue exists where the secret scanning validator for GCP service account credentials trusts the token endpoint embedded in a committed credential and issues a request to it without restricting the destination. This allows a repository contributor to force the appliance to send requests to internal hosts controlled by an attacker, which could be chained to achieve remote code execution. Exploitation requires an authenticated user with permissions to push to a repository on an instance where GitHub Advanced Security and secret scanning validity checks are enabled.

Recommendations Update GitHub Enterprise Server version 3.20 to 3.20.9. Update GitHub Enterprise Server version 3.21 to 3.21.7. Update GitHub Enterprise Server version 3.22 to 3.22.2.