GitHub Enterprise Server CVE-2026-6736

Exploitation requires external authentication (SAML, LDAP, or OAuth) to be explicitly enabled on the GHES instance. The vulnerability does NOT affect instances using GitHub's default local authentication or those with external authentication disabled. Additionally, the attack timing constraint (AT:P in CVSS vector) indicates exploitation may depend on specific temporal conditions or ordering of requests during the signup flow; attackers may need to exploit within a narrow window or under specific request sequencing. Network access to the GHES signup endpoint is mandatory; instances protected by network segmentation (firewall rules, VPN-only access) significantly reduce exploitation likelihood. The created accounts are subject to the instance's default base permissions, so exploitation impact is limited by the permissiveness of those defaults.

This vulnerability presents moderate real-world risk with specific operational conditions. CVSS 4.0 score of 6.3 with AV:N/AC:L/PR:N/UI:N indicates unauthenticated network access with low attack complexity, but the AT:P (attack timing) component and VC:L (low confidentiality impact) suggest limited exploitation window or constraint. The primary risk is account enumeration and privilege escalation within the GHES instance, not full system compromise. Organizations relying on external identity providers for access control face direct policy bypass, allowing attackers to establish persistent access outside IdP governance. However, the created accounts receive only default base permissions, limiting lateral movement unless default permissions are overly permissive. Risk is significantly amplified for instances exposed to the internet without network segmentation; internal GHES deployments with network-level access controls face lower exploitation likelihood. The availability of vendor-released patches across all affected version branches (3.16.18, 3.17.15, 3.18.9, 3.19.6, 3.20.2) and the clear exploitation path (unauthenticated signup) justify high priority for patching, particularly for internet-facing deployments.

An attacker discovers a GHES instance (e.g., via DNS enumeration or network scanning) configured with external SAML authentication. The attacker sends a crafted HTTP POST request to the /signup endpoint with a username, email, and password, bypassing SAML validation. GitHub Enterprise Server creates the local account and issues a valid session token. The attacker logs in with the new account, gaining access to repositories and data accessible via default permissions, and potentially escalates privileges if default permissions include repository or organization roles.