GitHub Enterprise Server 3.20.3 — Pre-Auth SSRF in Upload Endpoint (CVE-2026-9312) + Bundled "Dirty Frag" Kernel LPEs (CVE-2026-43284, CVE-2026-43500) + Mandatory GPG Signing Key Rotation — Threadlinqs Intelligence
As of 2026-05-30, GitHub Enterprise Server 3.20.3 — Pre-Auth SSRF in Upload Endpoint (CVE-2026-9312) + Bundled "Dirty Frag" Kernel LPEs (CVE-2026-43284, CVE-2026-43500) + Mandatory GPG Signing Key Rotation is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-0605 · Severity: CRITICAL · CVSS: 9.6 · Status: MONITORING · Category: VULNERABILITY
GitHub Enterprise Server (GHES) 3.20.3 closes a critical pre-authentication server-side request forgery vulnerability in an upload endpoint (CVE-2026-9312) that let a network-adjacent attacker coerce
GitHub Enterprise Server 3.20.3, released on 2026-05-27, is a security-driven patch release that closes one critical and multiple high-severity vulnerabilities in the self-hosted GHES appliance and rotates the GPG key used to sign GHES release packages.
## CVE-2026-9312 — Pre-Auth SSRF in Upload Endpoint (Critical)
The headline fix is a critical pre-authentication server-side request forgery in a GHES upload endpoint. Input parameters accepted by the endpoint were not strictly validated, allowing a network-adjacent attacker — with no authentication required — to craft upload requests that caused the GHES server to issue internal HTTP calls to attacker-controlled destinations and internal addresses. Because the request originates from the GHES appliance itself, the attacker can reach internal services on the same network segment, the appliance's own loopback management interfaces, and cloud metadata endpoints (e.g. 169.254.169.254 on AWS/Azure/GCP-hosted instances), potentially exfiltrating instance credentials, IAM role tokens, environment configuration, and other secrets accessible to the appliance.
The vulnerability is a general-purpose SSRF primitive: response data and timing differences can be observed to enumerate internal services and to perform blind SSRF against authenticated internal APIs. Reported via the GitHub Bug Bounty program. GitHub mitigated by tightening input validation, applying destination allow-listing to the endpoint, and preventing the upload path from emitting arbitrary outbound HTTP requests.
## CVE-2026-43284 & CVE-2026-43500 — "Dirty Frag" Kernel LPEs (High)
GHES 3.20.3 also ships an updated bundled Linux kernel that fixes two high-severity local privilege-escalation flaws collectively branded "Dirty Frag" — one in the IPsec ESP (XFRM) subsystem (CVE-2026-43284) and one in the RxRPC networking subsystem (CVE-2026-43500). The Dirty Frag family of bugs abuses fragmentation/coalescing logic in the kernel networking path to drive an out-of-bounds page-cache write, allowing a local unprivileged user with shell access on the appliance to corrupt kernel memory and gain root.
In the GHES context this is most dangerous on multi-tenant or large-team appliances where multiple internal users, CI runners, or automated processes have shell access (admin shell, support-bundle generation contexts, scripted maintenance). A low-privileged foothold (e.g. an attacker who chained the SSRF, leveraged a separate webshell, or compromised a legitimate operator account) can be reliably escalated to root, granting full control over the underlying OS, the entire Git data set, all repository secrets, and all customer source code stored on the appliance.
## CVE-2026-5921 & CVE-2026-8606 — Additional Hardening
GHES 3.20.3 also rolls in fixes carried over from earlier 3.20.x updates: a timing side-channel in the notebook viewer that could leak environment variables to an attacker (CVE-2026-5921), and an internal packages endpoint that could be abused for unauthenticated SSRF when private mode is disabled (CVE-2026-8606). Both were reported through the GitHub Bug Bounty program.
## GPG Signing Key Rotation (Operational Hard Gate)
As part of this release, GitHub has revoked the previous GPG signing key for GHES release packages and signed 3.20.3 (and all subsequent images) with a new key. Administrators must run GitHub's official key-rotation script/procedure to install the new trusted public key on every appliance before attempting the 3.20.3 upgrade. Skipping the rotation step will cause the appliance's signature verification to fail and the upgrade to be blocked — delaying deployment of the SSRF and kernel LPE fixes.
## Operational Impact and Recommended Posture
Any GHES appliance reachable from a less-trusted network is at risk of pre-auth SSRF exploitation; if shell access is shared by multiple teams, the chained SSRF -> credential theft -> remote authenticated foothold -> kernel LPE -> root path is realistic. GitHu
Weaknesses (CWE)
CWE-918, CWE-20, CWE-787, CWE-119, CWE-203, CWE-200, CWE-269
Target sectors: technology, financial, government, defense, healthcare, manufacturing, telecommunications, education, energy
Target regions: Global, North America, Europe, Asia-Pacific
Timeline
- External researchers submit reports of multiple SSRF and secret-exposure issues in GitHub Enterprise Server 3.20.x via the GitHub Bug Bounty program, including the upload-endpoint SSRF later assigned CVE-2026-9312.
- GitHub engineering identifies that the bundled GHES Linux kernel is affected by two high-severity local privilege-escalation flaws in the IPsec ESP (XFRM) and RxRPC subsystems, later branded "Dirty Frag." GitHub requests CVE-2026-43284 and CVE-2026-43500.
- GitHub decides to rotate the GPG signing key used to sign GHES release packages as part of the 3.20.3 release; engineering develops the official key-rotation script and admin procedure.
- CVE-2026-5921 (notebook viewer timing side-channel — environment-variable leak) and CVE-2026-8606 (internal packages endpoint unauthenticated SSRF when private mode is disabled) assigned for issues found via the bug bounty program.
- GHES 3.20.3 image finalized with patched kernel, tightened upload-endpoint validation, destination allow-listing, and re-signed with the new GPG signing key.
- GitHub publishes GHES 3.20.3 with security advisories for CVE-2026-9312, CVE-2026-43284, CVE-2026-43500, CVE-2026-5921, and CVE-2026-8606. Cyber Security News publishes coverage and signing-key-rotation guidance.
- GitHub Bug Bounty disclosures and NVD entries published; administrators advised to run GPG key rotation BEFORE upgrade to avoid signature-verification failure.
- Threadlinqs Intelligence assigns TL-2026-0605 and begins research, detection, and simulation pipeline.
- No confirmed in-the-wild exploitation at time of disclosure; no public proof-of-concept yet. Risk assessment driven by network reachability, lack of authentication, and chained SSRF -> credential theft -> kernel LPE path.
- As of 2026-05-29, GitHub fixed all five CVEs in GHES 3.20.3 (NVD lists branch fixes 3.20.4/3.21.1) and none are in CISA KEV with no confirmed in-the-wild exploitation. It stays a live concern: public Dirty Frag (CVE-2026-43284/43500) exploit code now circulates after a May 7 embargo break, so unpatched 3.20.x appliances remain at risk.
Detections & IOCs
As of 2026-09-04, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-9312, CVE-2026-43284, CVE-2026-43500, CVE-2026-5921, CVE-2026-8606, T1595, T1590, T1587, T1190, T1078, T1203, T1059, T1098, T1543, T1068
