CVE-2026-76851

CVE-2026-76851 is a server-side request forgery (SSRF) flaw in GitHub Enterprise Server in which insufficient network isolation lets malicious pre-receive hook code impersonate an internal service and redirect trusted internal requests to a privileged service. Exploitation requires pre-receive hook networking to be enabled on the instance, plus either site administrator privileges or write access to a repository that has a pre-receive hook configured. An attacker who meets those conditions gains remote code execution with elevated privileges on the GHES instance. All versions of GitHub Enterprise Server prior to 3.22 are affected, which applies to enterprise self-hosted or GitHub-managed instances rather than the github.com SaaS service. No public proof-of-concept or known in-the-wild exploitation exists; EPSS estimates the 30-day exploitation probability at about 0.5%.

What to do: Upgrade GitHub Enterprise Server to 3.17.20, 3.18.14, 3.19.11, 3.20.7, or 3.21.5 (or move to 3.22 or later). In the meantime, check whether pre-receive hook networking is enabled on your instance and audit which users hold site admin rights or write access to repositories with configured pre-receive hooks, restricting hook code to trusted authors. The issue was reported through GitHub's Bug Bounty program and is not currently listed in CISA's KEV.