Summary
CVE-2026-18730 is a server-side request forgery (SSRF) vulnerability in GitHub Enterprise Server (GHES) affecting an unauthenticated Manage API endpoint. The endpoint processed attacker-supplied cluster configuration data and could be abused to make the server issue crafted outbound requests to an attacker-controlled host, exposing a replayable gateway-to-agent bearer token. The issue is rated HIGH severity and does not require authentication to trigger.
Technical details
- Root cause: An unauthenticated Manage API endpoint parsed attacker-supplied cluster settings and used them to construct gateway-to-agent requests.
- Trigger conditions: The gateway-to-agent request authentication (HMAC) validated only the request timestamp, not the request path or body, allowing a captured token to be replayed against other privileged management agent endpoints.
- Attack vector: Network-based; no authentication or user interaction required. An attacker positioned to intercept the outbound request (e.g., on the network path) could capture the bearer token.
- Impact: Disclosure and replay of a management bearer token usable against restricted GHES management agent endpoints. High-availability deployments were not affected due to network topology constraints.
Affected software
- GitHub Enterprise Server 3.17.0 – 3.17.19 (fixed in 3.17.20)
- GitHub Enterprise Server 3.18.0 – 3.18.13 (fixed in 3.18.14)
- GitHub Enterprise Server 3.19.0 – 3.19.10 (fixed in 3.19.11)
- GitHub Enterprise Server 3.20.0 – 3.20.6 (fixed in 3.20.7)
- GitHub Enterprise Server 3.21.0 – 3.21.4 (fixed in 3.21.5)
Severity
CVSS v4.0 Base Score: 8.2 (High)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Mitigation and recommended actions
- Immediate: Upgrade GitHub Enterprise Server to the fixed release for your branch: 3.17.20, 3.18.14, 3.19.11, 3.20.7, or 3.21.5 (all released 2026-08-25).
- Prioritize patching for standalone (non-high-availability) deployments, as HA topology was noted to reduce exposure to this specific issue.
- Review Manage API and management agent access logs for anomalous cluster-configuration submissions or unexpected outbound requests preceding the patch date.
How IONIX identifies potentially affected assets
IONIX matches the following signals against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- Set-Cookie response header:
_fi_sess - Raw HTTP response body:
_fi_sess

