Vulnerabilities

CVE-2026-18730 is a server-side request forgery (CWE-918) in the Manage API of GitHub Enterprise Server (GHES) that lets an unauthenticated attacker cause the instance to send crafted outbound requests to an attacker-controlled host. The flaw stems from an unauthenticated endpoint that parses an attacker-supplied cluster configuration and issues gateway-to-agent requests whose HMAC token authenticates only a timestamp, not the request path or body, so an attacker positioned to intercept the outbound request can capture the token. By replaying the captured token against privileged management agent endpoints, the attacker gains unauthorized access to management functionality, with the primary impact being disclosure of confidential management information (CVSS v4 rates confidentiality impact High, with no integrity or availability impact). All GHES versions prior to 3.22 are affected; fixes are available in 3.17.19, 3.18.13, 3.19.10, 3.20.6, and 3.21.4, and high-availability deployments are explicitly not affected due to a topology restriction. No public proof of concept, no CISA KEV listing, and a low EPSS score (0.3%, 23rd percentile) indicate no known exploitation at this time.

Do: Upgrade GitHub Enterprise Server to 3.17.19, 3.18.13, 3.19.10, 3.20.6, or 3.21.4 (or any 3.22+ release). Audit whether your deployment runs the affected non-HA/clustered topology, whether the unauthenticated Manage API endpoint is reachable, and whether management agent tokens should be rotated if instances could have been observed. High-availability deployments are not affected and need no action under this advisory.

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets, attachments, and avatars. The X-GitHub-Request-Id request header was used without sanitization as a filesystem path segment for the upload buffer directory, so a traversal value pointed the buffer at an arbitrary path and the deferred cleanup routine recursively removed the traversed target. Exploitation required only network reachability to the instance and no authentication, and it worked even when private mode was enabled. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.4, 3.20.6, 3.19.10, 3.18.13 and 3.17.19. This vulnerability was reported via the GitHub Bug Bounty program.

GitHub MCP Server versions prior to 1.1.0 contain a nil pointer dereference (CWE-476) in the CompletionsHandler function in pkg/github/server.go, which accesses the ref field of a completion request without first verifying it is present. Any unauthenticated client able to send JSON-RPC messages to the server can trigger the flaw by issuing a completion/complete request with a missing or empty ref field. Because the dereference happens before any authentication or token validation, the resulting Go runtime panic crashes the server and yields a complete denial of service. All deployments running an affected version are potentially affected, with the greatest risk for instances reachable over a network by unauthenticated clients, while locally run stdio instances are only reachable by their local client. No widespread exploitation is reported (0.4% EPSS, not in CISA KEV), but a public security advisory documents the issue and the triggering request is trivial to craft.

Do: Upgrade to GitHub MCP Server 1.1.0 or later, which adds the missing nil check in CompletionsHandler. Until patched, restrict any HTTP/SSE-exposed instance with authentication or network allowlisting, since the crashing request requires no credentials. Audit deployments to determine which are network-reachable versus local-only, and watch for unauthenticated completion/complete requests that crash the process.

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to perform certain write operations on public repositories outside the token's intended scope. This was possible because the authorization check only verified that the installation had read permissions on the target repository rather than verifying that the token's installation was explicitly granted access to that repository. An attacker who obtained a victim's user-to-server token could create issues, issue comments, commit comments, and private vulnerability reports on any public repository, appearing as the victim user with no indication of the app involvement. This vulnerability was fixed by adding a repository scope check for user-to-server tokens issued by global apps. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program.

A stored cross-site scripting vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to execute arbitrary JavaScript in another user's browser by injecting a crafted payload into the title of a Discussion in the Q&A category. The AnsweredQuestionStructuredDataComponent did not escape user-controlled Discussion titles before embedding them in a block, allowing the title to break out of the script context. The injection was escalated to a full cross-site scripting attack on GitHub Enterprise Server by leveraging JSONP callback support in the REST API to bypass the Content Security Policy. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program.