GITHUB has released security updates for four vulnerabilities in GitHub Enterprise Server, affecting the 3.17, 3.18, 3.19, 3.20, 3.21 and 3.22 series. The most serious, CVE-2026-77987, is rated 9.3 under CVSSv4 and affects the notebook viewer. According to the report, an attacker could submit a URL containing an explicit port and use response timing to probe internal services, potentially extracting instance secrets and achieving remote code execution.
CVE-2026-18730, rated 8.2, affects the Manage API and could allow an unauthenticated attacker to obtain a replayable gateway-agent bearer token through malicious cluster configuration; high-availability deployments are described as unaffected because of topology restrictions.
The other issues are CVE-2026-77912, rated 7.4, a stored cross-site scripting flaw in Markdown rendering that could allow authenticated users to inject HTML attributes, and CVE-2026-75101, rated 6.0, an authorisation bypass exposing private pull-request diffs and patches through repository-name collisions. The source reports no confirmed exploitation in the wild and no public proof-of-concept code.
GitHub Enterprise Server administrators should apply the relevant updates: 3.17.21, 3.18.15, 3.19.12, 3.20.8, 3.21.6 or 3.22.1. The fixes include rejecting notebook-viewer URLs with explicit ports and adding authorisation checks for package uploads.