CVE-2026-18730 is a high severity (CVSS 7.4) server-side request forgery in the Manage API of GitHub Enterprise Server. An unauthenticated attacker could make the instance send crafted outbound requests, and a captured token could be replayed. Fixed in 3.17.21, 3.18.15, 3.19.12, 3.20.8 and 3.21.6.
What's affected
GitHub's record says releases in the 3.17, 3.18, 3.19, 3.20 and 3.21 series were affected, and fixed in:
- 3.17.21
- 3.18.15
- 3.19.12
- 3.20.8
- 3.21.6
High-availability deployments were not affected, because of a topology restriction. The release notes we read list the fix under the 3.21.5 entry and again in 3.21.6, so check the notes for the series you run. GitHub rates the issue High but the release note does not give a CVSS score. The 7.4 score in the record comes from NVD. The issue was reported through the GitHub Bug Bounty program, and the KEV flag is false.
How to check if you're exposed
Open the Management Console or run the version check from the administrative shell:
ghe-version
Compare the result with the fixed releases above for your series. A version below the fixed release in the same series is affected.
Then check whether the instance runs in a high availability topology. GitHub says those deployments were not affected, so single node or other topologies are the ones to prioritize.
Finally, review network paths from the appliance to the internet. The weakness involves outbound requests to an attacker-chosen host, so egress controls reduce what the flaw can reach.
What to do now
- Check your GitHub Enterprise Server version with the administrative shell or console.
- Upgrade to the fixed release for your series: 3.17.21, 3.18.15, 3.19.12, 3.20.8 or 3.21.6, or a newer one.
- Take a backup using GitHub's backup utilities before upgrading.
- Limit access to the management port to administrators and trusted networks.
- Add egress filtering from the appliance so it can reach only the destinations it needs.
- Rotate management credentials if you suspect interception of traffic from the appliance.
Why it matters
The weakness class is CWE-918, server-side request forgery. An endpoint that did not require authentication read a cluster configuration supplied by the caller, and then sent gateway to agent requests based on it. Those requests carried an HMAC that covered only a timestamp, not the request path or body.
That design gap matters in two ways. The attacker steers where requests go, and a signature that covers only a timestamp can be replayed against other privileged management endpoints by anyone who captures it. GitHub says the attacker must be positioned to intercept the outbound request, which is why the score is not higher. The lesson for builders is to sign the full request, not just a time value.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Are high-availability setups affected?
GitHub says no, because of a topology restriction.
Is there a CVSS score from GitHub?
The release notes we read give only a High rating. The 7.4 score in the record comes from NVD.
Sources
Last reviewed: 18 October 2026.
