CVE-2026-8034

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21

Description A server-side request forgery (SSRF) issue exists in the notebook viewer. This occurs due to URL parser confusion between the validation layer and the HTTP request library, where the hostname validation uses a different parser than the request library. This allows a crafted URL to bypass validation and direct requests to unintended internal services. Exploitation requires network access to the instance.

Recommendations Update to version 3.16.18 Update to version 3.17.15 Update to version 3.18.9 Update to version 3.19.6 Update to version 3.20.2 Update to version 3.21 or later