CVE-2026-76851

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.22

Description A Server-Side Request Forgery (SSRF) issue exists where insufficient network isolation allows malicious pre-receive hook code to impersonate an internal service. This enables the redirection of trusted internal requests to a privileged service, resulting in remote code execution on the instance. Exploitation requires pre-receive hook networking to be enabled and either site administrator privileges or write access to a repository with a configured pre-receive hook.

Recommendations Update to version 3.17.20 Update to version 3.18.14 Update to version 3.19.11 Update to version 3.20.7 Update to version 3.21.5 Disable pre-receive hook networking as a temporary mitigation measure.