CVE-2026-8034 Details
Description
A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusion between the validation layer and the HTTP request library. The hostname validation used a different URL parser than the request library, enabling a crafted URL to pass validation while directing the request to an unintended host. Exploitation required network access to the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.16.18, 3.17.15, 3.18.9, 3.19.6, and 3.20.2. This vulnerability was reported via the GitHub Bug Bounty program.
A server-side request forgery (SSRF) vulnerability exists in the GitHub Enterprise Server notebook viewer, affecting all versions prior to 3.21. This vulnerability allows attackers to access internal services by exploiting a mismatch in URL parsing between the validation layer and the HTTP request library. Exploitation requires network access to the GitHub Enterprise Server instance with private mode disabled.
This vulnerability has been fixed in GitHub Enterprise Server versions 3.16.18, 3.17.15, 3.18.9, 3.19.6, and 3.20.2.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.github.com/en/[email protected]/admin/release-notes#3.16.18 | [email protected] | Release NotesVendor Advisory |
| https://docs.github.com/en/[email protected]/admin/release-notes#3.17.15 | [email protected] | Release NotesVendor Advisory |
| https://docs.github.com/en/[email protected]/admin/release-notes#3.18.9 | [email protected] | Release NotesVendor Advisory |
| https://docs.github.com/en/[email protected]/admin/release-notes#3.19.6 | [email protected] | Release NotesVendor Advisory |
| https://docs.github.com/en/[email protected]/admin/release-notes#3.20.2 | [email protected] | Release NotesVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-436 | Interpretation Conflict | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| github enterprise server | < 3.16.18 >= 3.17.0, < 3.17.15 >= 3.18.0, < 3.18.9 >= 3.19.0, < 3.19.6 >= 3.20.0, < 3.20.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | Initial Analysis | [email protected] |
| May 7, 2026 | New CVE Received | [email protected] |