Summary
generated automatically from NVD dataCVE-2026-8034 is a server-side request forgery (SSRF) flaw in the notebook viewer of GitHub Enterprise Server. The hostname validation and the HTTP request library used different URL parsers, so a crafted URL could pass the check while the request went to an unintended host, exposing internal services to a network attacker. It affected versions prior to 3.21 and was fixed in 3.16.18, 3.17.15, 3.18.9, 3.19.6, and 3.20.2; it carries a CVSS v3.1 score of 9.8 (CRITICAL).
NVD description
A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusion between the validation layer and the HTTP request library. The hostname validation used a different URL parser than the request library, enabling a crafted URL to pass validation while directing the request to an unintended host. Exploitation required network access to the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.16.18, 3.17.15, 3.18.9, 3.19.6, and 3.20.2. This vulnerability was reported via the GitHub Bug Bounty program.
EPSS · FIRST.org
0.86%probability of exploitation in the next 30 days
Higher than 57% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 7 mai 2026
- Updated
- 17 juin 2026
- Status
- Analyzed
- Source
- product-cna@github.com
Affected products
Weaknesses (CWE)
References (5)
- https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18Release NotesVendor Advisory
- https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.15Release NotesVendor Advisory
- https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.9Release NotesVendor Advisory
- https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6Release NotesVendor Advisory
- https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2Release NotesVendor Advisory
Similar CVEs
Other vulnerabilities of type CWE-436
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.