GitHub Enterprise Server EUVD-2026-84872

Requires network access to the GitHub Enterprise Server appliance and use of the notebook viewer feature, which validates a user-supplied URL's scheme and host but not its port - enabling requests to internal services on other ports of the same appliance. Exploitation is unauthenticated when private mode is disabled, but requires any authenticated user when private mode is enabled (a common enterprise hardening setting that limits the unauthenticated attack surface). Full impact depends on the multi-step timing-oracle secret extraction succeeding and a usable internal service being reachable for the follow-on RCE. Affected versions are 3.17 through 3.22; upgrading to 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, or 3.17.21 removes the condition.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk case. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) reflects a network-reachable flaw that chains from SSRF to full remote code execution on the appliance - total confidentiality, integrity, and availability impact. I differ on complexity: the exploit relies on a response-timing oracle to extract instance secrets one character at a time, which in practice is a probabilistic, iterative side-channel rather than a single deterministic request, so AC:H is more defensible than the vendor's AC:L. No EPSS score, KEV listing, or public POC is provided, so exploitation status is: no public exploit identified at time of analysis. The flaw was found and reported through the GitHub Bug Bounty program (source GitHub_P) and fixed across all supported branches, which argues for prompt patching despite the absence of active-exploitation signals. Note the PR ambiguity: exploitation is unauthenticated only when private mode is disabled; with private mode enabled (common in enterprise deployments) it requires any authenticated user, so the effective privilege prerequisite depends on instance configuration.

An attacker with network access to a GitHub Enterprise Server appliance submits a notebook containing a URL that passes scheme and host validation but points to an internal service on an unvalidated port. Because response timing leaks whether guessed characters are correct, the attacker extracts instance secrets character by character, then replays a secret against an internal service to achieve remote code execution on the appliance. No public exploit code is identified; exploitation is unauthenticated when private mode is disabled or requires any authenticated user when private mode is enabled.