CVE-2026-77987 is a critical (CVSS 9.8) server-side request forgery in the GitHub Enterprise Server notebook viewer that can end in remote code execution. It is fixed in 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15 and 3.17.21. Upgrade to the patch for your release line.
What's affected
- Product: GitHub Enterprise Server (GHES).
- Affected: 3.17 through 3.22.
- Fixed: 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15 and 3.17.21.
- Weakness: CWE-208, observable timing discrepancy, and CWE-918, server-side request forgery.
- CVSS 9.8 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Not listed in CISA KEV.
GitHub says exploitation was unauthenticated when private mode was disabled, and needed any authenticated user when private mode was enabled. It was reported through the GitHub Bug Bounty program.
How to check if you're exposed
On the appliance, check the version from the administrative shell.
ghe-version
You can also read it in the Management Console. Compare it with the fixed versions above. Then check the network exposure of the instance, since the issue needs network access to it.
What to do now
- Check your GHES version and pick the fixed patch for your release line.
- Take a backup or snapshot, then upgrade using the GitHub upgrade process for your hypervisor.
- Turn on private mode if it is off and your policy allows it, since it raises the bar from unauthenticated to authenticated.
- Limit network access to the instance to the networks that need it.
- After the upgrade, consider rotating instance secrets if you have reason to think the instance was probed, and review audit logs.
Why it matters
The notebook viewer checked the scheme and host of a URL a user supplied, but not the port. That let a request reach other services on the same appliance. Response bodies were not returned, but response timing worked as an oracle. The record says secrets could be extracted character by character, then used against an internal service to get code execution.
It is a good reminder that blind SSRF still matters. Even without a response, timing can leak. Validate the full destination, including the port, and keep internal services on addresses and ports a fetcher can never reach.
Quick check
Do I have to be signed in to exploit it?
Not if private mode is disabled. With private mode on, any authenticated user could.
Is it exploited in the wild?
The record does not mark it as a CISA KEV entry, and the release notes I read do not say so.
Sources
Last reviewed: 19 October 2026.
