CVE-2026-96890 is a high severity (CVSS 8.8) server-side request forgery in GitHub Enterprise Server 3.20, 3.21 and 3.22. A committed GCP credential could point the secret scanning validity check at an internal host. GitHub fixed it in 3.20.9, 3.21.7 and 3.22.2.
What's affected
GitHub's release notes list the fix in Enterprise Server 3.20.9, 3.21.7 and 3.22.2, and the record says the issue affected the 3.20, 3.21 and 3.22 series. The weakness is CWE-918, server-side request forgery. GitHub labels the issue High in the 3.20.9 notes. I read the 3.20.9 notes directly. The 3.21.7 and 3.22.2 fix versions come from the record and its references.
The release notes explain the cause: the secret scanning validator for GCP service account credentials trusted the token endpoint embedded in a committed credential, and sent a request to it without restricting the destination. An attacker could therefore make the appliance send requests to chosen internal hosts, which the description says could be chained to remote code execution.
Exploitation needed an authenticated user with push access to a repository, on an instance with GitHub Advanced Security and secret scanning validity checks enabled. That is a non default configuration, and it was reported through GitHub's bug bounty program.
How to check if you're exposed
On the appliance, check the version.
ghe-version
The version is also shown in the management console. Instances on 3.20.8 or lower, 3.21.6 or lower, and 3.22.1 or lower are in scope.
Then check whether the non default conditions apply: is GitHub Advanced Security licensed, and are secret scanning validity checks turned on? If either is off, the described path is not available, but you should still upgrade.
What to do now
- Upgrade to GitHub Enterprise Server 3.20.9, 3.21.7 or 3.22.2 or later, following GitHub's upgrade documentation.
- If you cannot upgrade right away, check whether validity checks for secret scanning are enabled and weigh whether you need them.
- Review who has push access to repositories on the instance.
- Restrict the appliance's outbound network access so it cannot reach internal management services it has no reason to call.
- Review outbound request logs from the appliance for unexpected internal destinations.
Why it matters
Validity checks make secret scanning more useful, because they tell you whether a leaked credential still works. They also mean the server makes network calls based on content that a user committed. CWE-918 arises when the server trusts a destination that came from that content. The fix is to restrict where such a call may go.
The path to code execution on the appliance is what lifts the score. Source code hosts hold the keys to a company's software, so a compromise there is serious. The record does not mark exploitation and the CVE is not in CISA's catalog. The narrow configuration lowers the number of affected instances, not the impact on those that match.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is every GitHub Enterprise Server affected?
Exploitation needed GitHub Advanced Security with secret scanning validity checks enabled, which is a non default configuration.
Which versions fix it?
3.20.9, 3.21.7 and 3.22.2.
Sources
- GitHub Enterprise Server 3.20.9 release notes
- GitHub Enterprise Server 3.21.7 release notes (referenced by the record)
- GitHub Enterprise Server 3.22.2 release notes (referenced by the record)
Last reviewed: 18 October 2026.
