CVE-2026-0573

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0573", "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "state": "PUBLISHED", "assignerShortName": "GitHub_P", "dateReserved": "2026-01-02T16:56:23.289Z", "datePublished": "2026-02-18T20:37:39.601Z", "dateUpdated": "2026-02-18T21:20:02.732Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Enterprise Server", "vendor": "GitHub", "versions": [{"changes": [{"at": "3.14.22", "status": "unaffected"}], "lessThanOrEqual": "3.14.21", "status": "affected", "version": "3.14", "versionType": "semver"}, {"changes": [{"at": "3.15.17", "status": "unaffected"}], "lessThanOrEqual": "3.15.16", "status": "affected", "version": "3.15", "versionType": "semver"}, {"changes": [{"at": "3.16.13", "status": "unaffected"}], "lessThanOrEqual": "3.16.12", "status": "affected", "version": "3.16", "versionType": "semver"}, {"changes": [{"at": "3.17.10", "status": "unaffected"}], "lessThanOrEqual": "3.17.9", "status": "affected", "version": "3.17", "versionType": "semver"}, {"changes": [{"at": "3.18.4", "status": "unaffected"}], "lessThanOrEqual": "3.18.3", "status": "affected", "version": "3.18", "versionType": "semver"}, {"changes": [{"at": "3.19.2", "status": "unaffected"}], "lessThanOrEqual": "3.19.1", "status": "affected", "version": "3.19", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "R31n"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgba(129, 139, 152, 0.12);\">An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens. The repository_pages API insecurely followed HTTP redirects when fetching artifact URLs, preserving the authorization header containing a privileged JWT. An authenticated user could redirect these requests to an attacker-controlled domain, exfiltrate the Actions.ManageOrgs JWT, and leverage it for potential remote code execution. Attackers would require access to the target GitHub Enterprise Server instance and the ability to exploit a legacy redirect to an attacker-controlled domain. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.19 and was fixed in versions 3.19.2, 3.18.4, 3.17.10, 3.16.13, 3.15.17, and 3.14.22. This vulnerability was reported via the GitHub Bug Bounty program.</span><br>"}], "value": "An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens. The repository_pages API insecurely followed HTTP redirects when fetching artifact URLs, preserving the authorization header containing a privileged JWT. An authenticated user could redirect these requests to an attacker-controlled domain, exfiltrate the Actions.ManageOrgs JWT, and leverage it for potential remote code execution. Attackers would require access to the target GitHub Enterprise Server instance and the ability to exploit a legacy redirect to an attacker-controlled domain. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.19 and was fixed in versions 3.19.2, 3.18.4, 3.17.10, 3.16.13, 3.15.17, and 3.14.22. This vulnerability was reported via the GitHub Bug Bounty program."}], "impacts": [{"capecId": "CAPEC-178", "descriptions": [{"lang": "en", "value": "CAPEC-178 Cross-Site Flashing"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 7.6, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "shortName": "GitHub_P", "dateUpdated": "2026-02-18T20:37:39.601Z"}, "references": [{"tags": ["release-notes"], "url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.22"}, {"tags": ["release-notes"], "url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.17"}, {"tags": ["release-notes"], "url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.13"}, {"tags": ["release-notes"], "url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.10"}, {"tags": ["release-notes"], "url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.4"}, {"tags": ["release-notes"], "url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.2"}], "source": {"discovery": "UNKNOWN"}, "title": "Improper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code execution", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-18T21:18:26.120107Z", "id": "CVE-2026-0573", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T21:20:02.732Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0573", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-18T21:18:26.120107Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T21:18:36.138Z"}}], "cna": {"title": "Improper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code execution", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "R31n"}], "impacts": [{"capecId": "CAPEC-178", "descriptions": [{"lang": "en", "value": "CAPEC-178 Cross-Site Flashing"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "GitHub", "product": "Enterprise Server", "versions": [{"status": "affected", "changes": [{"at": "3.14.22", "status": "unaffected"}], "version": "3.14", "versionType": "semver", "lessThanOrEqual": "3.14.21"}, {"status": "affected", "changes": [{"at": "3.15.17", "status": "unaffected"}], "version": "3.15", "versionType": "semver", "lessThanOrEqual": "3.15.16"}, {"status": "affected", "changes": [{"at": "3.16.13", "status": "unaffected"}], "version": "3.16", "versionType": "semver", "lessThanOrEqual": "3.16.12"}, {"status": "affected", "changes": [{"at": "3.17.10", "status": "unaffected"}], "version": "3.17", "versionType": "semver", "lessThanOrEqual": "3.17.9"}, {"status": "affected", "changes": [{"at": "3.18.4", "status": "unaffected"}], "version": "3.18", "versionType": "semver", "lessThanOrEqual": "3.18.3"}, {"status": "affected", "changes": [{"at": "3.19.2", "status": "unaffected"}], "version": "3.19", "versionType": "semver", "lessThanOrEqual": "3.19.1"}], "defaultStatus": "affected"}], "references": [{"url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.22", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.17", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.13", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.10", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.4", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.2", "tags": ["release-notes"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens. The repository_pages API insecurely followed HTTP redirects when fetching artifact URLs, preserving the authorization header containing a privileged JWT. An authenticated user could redirect these requests to an attacker-controlled domain, exfiltrate the Actions.ManageOrgs JWT, and leverage it for potential remote code execution. Attackers would require access to the target GitHub Enterprise Server instance and the ability to exploit a legacy redirect to an attacker-controlled domain. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.19 and was fixed in versions 3.19.2, 3.18.4, 3.17.10, 3.16.13, 3.15.17, and 3.14.22. This vulnerability was reported via the GitHub Bug Bounty program.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgba(129, 139, 152, 0.12);\">An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens. The repository_pages API insecurely followed HTTP redirects when fetching artifact URLs, preserving the authorization header containing a privileged JWT. An authenticated user could redirect these requests to an attacker-controlled domain, exfiltrate the Actions.ManageOrgs JWT, and leverage it for potential remote code execution. Attackers would require access to the target GitHub Enterprise Server instance and the ability to exploit a legacy redirect to an attacker-controlled domain. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.19 and was fixed in versions 3.19.2, 3.18.4, 3.17.10, 3.16.13, 3.15.17, and 3.14.22. This vulnerability was reported via the GitHub Bug Bounty program.</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "shortName": "GitHub_P", "dateUpdated": "2026-02-18T20:37:39.601Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0573", "state": "PUBLISHED", "dateUpdated": "2026-02-18T21:20:02.732Z", "dateReserved": "2026-01-02T16:56:23.289Z", "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "datePublished": "2026-02-18T20:37:39.601Z", "assignerShortName": "GitHub_P"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Enterprise Server", "vendor": "GitHub", "versions": [{"changes": [{"at": "3.14.22", "status": "unaffected"}], "lessThanOrEqual": "3.14.21", "status": "affected", "version": "3.14", "versionType": "semver"}, {"changes": [{"at": "3.15.17", "status": "unaffected"}], "lessThanOrEqual": "3.15.16", "status": "affected", "version": "3.15", "versionType": "semver"}, {"changes": [{"at": "3.16.13", "status": "unaffected"}], "lessThanOrEqual": "3.16.12", "status": "affected", "version": "3.16", "versionType": "semver"}, {"changes": [{"at": "3.17.10", "status": "unaffected"}], "lessThanOrEqual": "3.17.9", "status": "affected", "version": "3.17", "versionType": "semver"}, {"changes": [{"at": "3.18.4", "status": "unaffected"}], "lessThanOrEqual": "3.18.3", "status": "affected", "version": "3.18", "versionType": "semver"}, {"changes": [{"at": "3.19.2", "status": "unaffected"}], "lessThanOrEqual": "3.19.1", "status": "affected", "version": "3.19", "versionType": "semver"}]}], "source": "product-cna@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "5B364775-45E7-4E82-8C8D-DBCD513523C3", "versionEndExcluding": "3.14.22", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "44763502-3158-4369-9EBB-8D87C16645FC", "versionEndExcluding": "3.15.17", "versionStartIncluding": "3.15.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "C3E68ACE-C628-4029-B7B4-1E08D502A24D", "versionEndExcluding": "3.16.13", "versionStartIncluding": "3.16.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "062A4133-114C-4643-BB73-1C37C0C188C6", "versionEndExcluding": "3.17.10", "versionStartIncluding": "3.17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "51E739B5-F9CF-4D7E-8240-FEE7E3D9F1A2", "versionEndExcluding": "3.18.4", "versionStartIncluding": "3.18.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "D8AE9F21-7596-446E-99B8-F09A230F173A", "versionEndExcluding": "3.19.2", "versionStartIncluding": "3.19.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens. The repository_pages API insecurely followed HTTP redirects when fetching artifact URLs, preserving the authorization header containing a privileged JWT. An authenticated user could redirect these requests to an attacker-controlled domain, exfiltrate the Actions.ManageOrgs JWT, and leverage it for potential remote code execution. Attackers would require access to the target GitHub Enterprise Server instance and the ability to exploit a legacy redirect to an attacker-controlled domain. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.19 and was fixed in versions 3.19.2, 3.18.4, 3.17.10, 3.16.13, 3.15.17, and 3.14.22. This vulnerability was reported via the GitHub Bug Bounty program."}, {"lang": "es", "value": "Una vulnerabilidad de redirecci\u00f3n de URL fue identificada en GitHub Enterprise Server la cual permit\u00eda a las redirecciones controladas por el atacante filtrar tokens de autorizaci\u00f3n sensibles. La API repository_pages segu\u00eda de forma insegura las redirecciones HTTP al obtener URLs de artefactos, preservando el encabezado de autorizaci\u00f3n que conten\u00eda un JWT privilegiado. Un usuario autenticado pod\u00eda redirigir estas solicitudes a un dominio controlado por el atacante, exfiltrar el JWT de Actions.ManageOrgs y aprovecharlo para una posible ejecuci\u00f3n remota de c\u00f3digo. Los atacantes requerir\u00edan acceso a la instancia de GitHub Enterprise Server objetivo y, tambi\u00e9n, la capacidad de explotar una redirecci\u00f3n heredada a un dominio controlado por el atacante. Esta vulnerabilidad afect\u00f3 a todas las versiones de GitHub Enterprise Server anteriores a la 3.19 y fue corregida en las versiones 3.19.2, 3.18.4, 3.17.10, 3.16.13, 3.15.17 y 3.14.22. Esta vulnerabilidad fue reportada a trav\u00e9s del programa GitHub Bug Bounty."}], "id": "CVE-2026-0573", "lastModified": "2026-06-17T10:10:58.443", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "product-cna@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0573", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-18T21:18:26.120107Z", "version": "2.0.3"}}]}, "published": "2026-02-18T21:16:22.470", "references": [{"source": "product-cna@github.com", "tags": ["Product", "Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.22"}, {"source": "product-cna@github.com", "tags": ["Product", "Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.17"}, {"source": "product-cna@github.com", "tags": ["Product", "Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.13"}, {"source": "product-cna@github.com", "tags": ["Product", "Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.10"}, {"source": "product-cna@github.com", "tags": ["Product", "Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.4"}, {"source": "product-cna@github.com", "tags": ["Product", "Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.2"}], "sourceIdentifier": "product-cna@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "product-cna@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.14,3.14.21]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.15,3.15.16]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.16,3.16.12]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.17,3.17.9]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.18,3.18.3]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.19,3.19.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Enterprise Server", "source": "cna", "vendor": "GitHub"}, "product": "enterprise_server", "vendor": "github"}], "analysis": {"en": {"generated_at": "2026-04-17T18:29:40.709660+00:00", "value": {"mitigation_remediation": ["Update GitHub Enterprise Server to the latest release (v3.19.2) or install the version\u2011specific patches (v3.18.4, v3.17.10, v3.16.13, v3.15.17, v3.14.22) that remove the vulnerable redirect handling.", "If an update cannot be applied immediately, disable or restrict the use of the repository_pages API and any endpoints that may trigger HTTP redirects until the fixes are applied.", "Monitor logs for unexpected outbound redirects and unusual token usage to detect possible exploitation attempts."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution via compromised authorization token"}, "threat_synthesis": {"affected_systems": "GitHub Enterprise Server for all releases prior to 3.19 is affected. The issue was resolved in releases 3.14.22, 3.15.17, 3.16.13, 3.17.10, 3.18.4, and 3.19.2; any older versions remain vulnerable.", "description_and_impact": "A flaw in the repository_pages API of GitHub Enterprise Server allowed the server to blindly follow HTTP redirects when retrieving artifact URLs, while preserving the Authorization header that contained a privileged JSON Web Token. The exposed token (Actions.ManageOrgs JWT) could be exfiltrated by redirecting the request to an attacker\u2011controlled domain, giving the attacker the means to execute arbitrary code on the target instance. The underlying weakness is a redirect handling issue (CWE\u2011601).", "risk_and_exploitability": "The vulnerability carries a CVSS score of 7.6 and an EPSS score of less than 1%, indicating very low current exploitation probability. It is not listed in the CISA KEV catalog. Attackers would need functional access to the target GitHub Enterprise Server instance and the ability to trigger the vulnerable redirect against a user\u2011authenticating context. The risk is moderate overall, but the potential for remote code execution warrants swift remediation."}}}}, "created": "2026-02-19T10:11:18.643784+00:00", "updated": "2026-04-17T18:30:05.663475+00:00", "vendors": ["github", "github$PRODUCT$enterprise_server"]}