GitHub Enterprise Server CVE-2026-9106

Exploitation requires three concurrent conditions: (1) the target GitHub Enterprise Server instance must be running any version prior to the patched releases (3.16.20 / 3.17.17 / 3.18.11 / 3.19.8 / 3.20.4 / 3.21.2); (2) the attacker must possess a valid GHES account sufficient to register an OAuth application; and (3) a victim who is a member of the target organization must be socially engineered into visiting the attacker-constructed OAuth authorization URL and actively clicking 'Authorize'. The scope of impact is limited to runner management within the victim's organization - it does not grant repository read/write access, administrative privileges, or access to other organizations. The attack cannot succeed without active victim participation (UI:A in the CVSS 4.0 vector confirms this), ruling out fully automated or mass exploitation.

The CVSS 4.0 score of 4.8 (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L) accurately characterizes this as a moderate-risk issue. The mandatory active user interaction (UI:A) and low-privilege attacker requirement (PR:L - a GHES account to register an OAuth application) prevent mass automated exploitation. There is no CISA KEV listing and no mention of a public proof-of-concept, making this a theoretical or targeted risk rather than an imminent widespread threat. The EPSS score is not provided in the input data, so exploitation probability cannot be quantified. Real-world impact is bounded by runner management capabilities: an attacker could potentially register or deregister runners, interfering with CI/CD pipeline availability or integrity. The 'Information Disclosure' tag in the CVE metadata understates the potential integrity impact to pipeline infrastructure. Overall, organizations running unpatched GHES with active OAuth usage face a meaningful but non-critical risk that scales with the sensitivity of their runner workloads.

An attacker with a GitHub Enterprise Server account registers a new OAuth application configured to request the manage_runners:org scope. They craft a phishing message directing a target organization member - ideally one with runner management privileges - to a URL that initiates the OAuth authorization flow for this application. Because the consent screen omits the manage_runners:org scope from display, the victim sees no indication of runner access being requested, approves the application, and the attacker's token is silently granted runner management capabilities over the victim's organization. No public proof-of-concept exists at time of analysis.