CVE-2026-8034 is a critical (CVSS 9.8) server-side request forgery in the GitHub Enterprise Server notebook viewer, caused by URL parser confusion. It is fixed in 3.16.18, 3.17.15, 3.18.9, 3.19.6 and 3.20.2, and in 3.21. Upgrade to the patch for your line.
What's affected
- Product: GitHub Enterprise Server (GHES).
- Affected: all versions before 3.21.
- Fixed: 3.16.18, 3.17.15, 3.18.9, 3.19.6 and 3.20.2.
- Weakness: CWE-436, interpretation conflict, and CWE-918, server-side request forgery.
- CVSS 9.8 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Not listed in CISA KEV.
GitHub says exploitation needed network access to the instance, and the issue was reported through its Bug Bounty program. A later notebook viewer bug, CVE-2026-77987, was fixed in newer patches, so aim for the latest patch in your line.
How to check if you're exposed
Check the version from the administrative shell.
ghe-version
Or read it in the Management Console. Compare it with the fixed versions above. If you are on 3.21 or later, you have the fix for this CVE. Also check how widely the instance is reachable.
What to do now
- Check your GHES version and the latest patch for your release line.
- Back up, then upgrade following the GitHub upgrade process. Prefer the latest patch, since it also covers CVE-2026-77987.
- Restrict network access to the instance to the networks that need it.
- Review audit logs for unusual outbound requests from the notebook viewer, if you log them.
Why it matters
The notebook viewer validated a hostname with one URL parser, and the HTTP library parsed the same string differently. A crafted URL could pass the check while the request went to a different host. The record lists this as URL parser confusion between the validation layer and the request library.
The fix pattern is to validate and request with the same parsed object. Never check a string with one parser and fetch it with another.
Quick check
Which version should I install?
Install the latest patch for your release line. That covers this CVE and the later notebook viewer issue CVE-2026-77987.
Sources
Last reviewed: 19 October 2026.
