CVE-2026-18730

CVE-2026-18730 is a server-side request forgery (CWE-918) in the Manage API of GitHub Enterprise Server (GHES) that lets an unauthenticated attacker cause the instance to send crafted outbound requests to an attacker-controlled host. The flaw stems from an unauthenticated endpoint that parses an attacker-supplied cluster configuration and issues gateway-to-agent requests whose HMAC token authenticates only a timestamp, not the request path or body, so an attacker positioned to intercept the outbound request can capture the token. By replaying the captured token against privileged management agent endpoints, the attacker gains unauthorized access to management functionality, with the primary impact being disclosure of confidential management information (CVSS v4 rates confidentiality impact High, with no integrity or availability impact). All GHES versions prior to 3.22 are affected; fixes are available in 3.17.19, 3.18.13, 3.19.10, 3.20.6, and 3.21.4, and high-availability deployments are explicitly not affected due to a topology restriction. No public proof of concept, no CISA KEV listing, and a low EPSS score (0.3%, 23rd percentile) indicate no known exploitation at this time.

What to do: Upgrade GitHub Enterprise Server to 3.17.19, 3.18.13, 3.19.10, 3.20.6, or 3.21.4 (or any 3.22+ release). Audit whether your deployment runs the affected non-HA/clustered topology, whether the unauthenticated Manage API endpoint is reachable, and whether management agent tokens should be rotated if instances could have been observed. High-availability deployments are not affected and need no action under this advisory.