CVE-2026-0573: falha de alta gravidade em GitHub Enterprise Server
Improper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code execution
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.6epss 0.7%
An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens. The repository_pages API insecurely followed HTTP redirects when fetching artifact URLs, preserving the authorization header containing a privileged JWT. An authenticated user could redirect these requests to an attacker-controlled domain, exfiltrate the Actions.ManageOrgs JWT, and leverage it for potential remote code execution. Attackers would require access to the target GitHub Enterprise Server instance and the ability to exploit a legacy redirect to an attacker-controlled domain. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.19 and was fixed in versions 3.19.2, 3.18.4, 3.17.10, 3.16.13, 3.15.17, and 3.14.22. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
GitHub · Enterprise ServerCVEs relacionadas — GitHub Enterprise Server
No mesmo produto, das mais perigosas para as menos.
CVE-2024-0200HIGHUnsafe Reflection in Github Enterprise Server leading to Command InjectionEPSS 71.7%CVE-2024-0507MEDIUMPrivilege Escalation by Code Injection in the Management Console in GitHub Enterprise ServerEPSS 65.8%CVE-2026-3854HIGHRemote code execution via git push option injection in GitHub Enterprise ServerEPSS 41.9%CVE-2024-9487CRITICALAn Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature was enabledEPSS 25.6%CVE-2026-9312CRITICALServer-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpointEPSS 9.2%CVE-2024-1374CRITICALCommand injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement ConsoleEPSS 2.6%
Referências
https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.22https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.17https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.13https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.10https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.4https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.2