CVE-2026-76851 is a high severity (8.8) server-side request forgery in GitHub Enterprise Server that allowed code execution on the instance. It needs pre-receive hook networking and either site admin rights or write access to a repository with a hook. Fixed in 3.17.20, 3.18.14, 3.19.11, 3.20.7 and 3.21.5.
What's affected
The record says all GitHub Enterprise Server versions before 3.22 were affected, and that fixes shipped in 3.17.20, 3.18.14, 3.19.11, 3.20.7 and 3.21.5. GitHub's release notes for those versions are the sources the record cites. The 3.17.20 release is dated 1 September 2026 on GitHub's page.
Exploitation needs two conditions, per the record: pre-receive hook networking is enabled, and the attacker is a site administrator or has write access to a repository that has a configured pre-receive hook. The issue was reported through the GitHub Bug Bounty program.
Where sources differ. We opened the 3.17, 3.18 and 3.19 release notes pages and they confirm the fixed patch releases exist, but we could not locate a separate entry that names this CVE in the text we retrieved. The version list therefore rests on the record. GitHub does not appear to give its own score in the pages we read, so only the record's 8.8 High is shown.
How to check if you're exposed
On the appliance, as an administrator over SSH, print the version:
ghe-version
Compare it with the fixed release for your series. If you run 3.22 or later, the record says you are past the affected range.
Then check the two preconditions. In the site admin settings, see whether pre-receive hook networking is enabled. List repositories with configured pre-receive hooks and who has write access to them, along with who your site administrators are. If hook networking is off, or the people with write access to hooked repositories are few and trusted, your practical exposure is lower, but it is still a code execution flaw on the server that holds your source.
What to do now
- Upgrade to 3.17.20, 3.18.14, 3.19.11, 3.20.7 or 3.21.5, or later in your series. GitHub's release notes list the fixes.
- Until then, review whether pre-receive hook networking is enabled and turn it off if you do not need it. The record names it as a precondition.
- Review who has write access to repositories with configured pre-receive hooks.
- Review site administrator accounts and remove any that are not needed.
- Check your audit logs for unexpected pre-receive hook changes. GitHub's audit log documentation explains how to search them.
Why it matters
The record says insufficient network isolation let malicious pre-receive hook code impersonate an internal service and redirect trusted internal requests to a privileged service, which led to elevated code execution. That is server-side request forgery, filed under CWE-918, used to cross a trust boundary inside the appliance.
Pre-receive hooks run custom code on the server during a push. That is useful for policy enforcement, and it also means a person with the right repository access already runs code on the box. The flaw turned that limited code execution into a more privileged one. The record does not mark it as a CISA KEV entry. For a self-hosted source control server, treat any path to server side code execution as urgent, even when it needs an insider role.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can an anonymous user exploit this?
No. The record says it needs site administrator privileges or write access to a repository with a configured pre-receive hook, and hook networking enabled.
Which version should I move to?
Upgrade to the fixed patch for your series: 3.17.20, 3.18.14, 3.19.11, 3.20.7 or 3.21.5, or move to 3.22 or later.
Sources
- GitHub Enterprise Server 3.17 release notes
- GitHub Enterprise Server 3.18 release notes
- GitHub Enterprise Server 3.19 release notes
Last reviewed: 18 October 2026.
