What is the CVSS score of CVE-2026-0573?

CVE-2026-0573 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Github are affected by CVE-2026-0573?

A critical vulnerability in GitHub Enterprise Server allows authenticated attackers to steal privileged authorization tokens through malicious URL redirects, potentially enabling unauthorized access…

How to fix or mitigate CVE-2026-0573?

Within 24 hours: Disable the repository_pages API if not actively required, audit recent API access logs for suspicious redirect patterns, and notify all GitHub Enterprise administrators. Within 7 days: Implement WAF rules to block suspicious redirect chains from the repository_pages endpoint, restrict API access to trusted IP ranges, and rotate all Actions.ManageOrgs tokens. Within 30 days: Establish a vendor patch monitoring process, conduct a security audit of all GitHub Enterprise integrations, and implement additional controls for token-bearing requests.

Github CVE-2026-0573

CRITICAL

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-02-18 product-cna@github.com

Github RCE Enterprise Server

9.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 18, 2026 - 21:16 nvd

CRITICAL 9.0

DescriptionGitHub Advisory

An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens. The repository_pages API insecurely followed HTTP redirects when fetching artifact URLs, preserving the authorization header containing a privileged JWT. An authenticated user could redirect these requests to an attacker-controlled domain, exfiltrate the Actions.ManageOrgs JWT, and leverage it for potential remote code execution. Attackers would require access to the target GitHub Enterprise Server instance and the ability to exploit a legacy redirect to an attacker-controlled domain. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.19 and was fixed in versions 3.19.2, 3.18.4, 3.17.10, 3.16.13, 3.15.17, and 3.14.22. This vulnerability was reported via the GitHub Bug Bounty program.

AnalysisAI

URL redirection vulnerability in GitHub Enterprise Server allows attacker-controlled redirects through crafted URLs, potentially enabling credential theft via phishing.

Technical ContextAI

CWE-601 open redirect. Crafted URLs can redirect authenticated users to attacker-controlled sites while appearing to originate from the trusted GitHub Enterprise domain.