GitHub Enterprise Server 3.20.3 — Pre-Auth SSRF in Upload Endpoint (CVE-2026-9312) + Bundled "Dirty Frag" Kernel LPEs (CVE-2026-43284, CVE-2026-43500) + Mandatory GPG Signing Key Rotation — Threadlinqs Intelligence
As of 2026-05-30, GitHub Enterprise Server 3.20.3 — Pre-Auth SSRF in Upload Endpoint (CVE-2026-9312) + Bundled "Dirty Frag" Kernel LPEs (CVE-2026-43284, CVE-2026-43500) + Mandatory GPG Signing Key Rotation is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-0605 · Severity: CRITICAL · CVSS: 9.6 · Status: MONITORING · Category: VULNERABILITY
GitHub Enterprise Server (GHES) 3.20.3 closes a critical pre-authentication server-side request forgery vulnerability in an upload endpoint (CVE-2026-9312) that let a network-adjacent attacker coerce
GitHub Enterprise Server 3.20.3, released on 2026-05-27, is a security-driven patch release that closes one critical and multiple high-severity vulnerabilities in the self-hosted GHES appliance and rotates the GPG key used to sign GHES release packages.
## CVE-2026-9312 — Pre-Auth SSRF in Upload Endpoint (Critical)
The headline fix is a critical pre-authentication server-side request forgery in a GHES upload endpoint. Input parameters accepted by the endpoint were not strictly validated, allowing a network-adjacent attacker — with no authentication required — to craft upload requests that caused the GHES server to issue internal HTTP calls to attacker-controlled destinations and internal addresses. Because the request originates from the GHES appliance itself, the attacker can reach internal services on the same network segment, the appliance's own loopback management interfaces, and cloud metadata endpoints (e.g. 169.254.169.254 on AWS/Azure/GCP-hosted instances), potentially exfiltrating instance credentials, IAM role tokens, environment configuration, and other secrets accessible to the appliance.
The vulnerability is a general-purpose SSRF primitive: response data and timing differences can be observed to enumerate internal services and to perform blind SSRF against authenticated internal APIs. Reported via the GitHub Bug Bounty program. GitHub mitigated by tightening input validation, applying destination allow-listing to the endpoint, and preventing the upload path from emitting arbitrary outbound HTTP requests.
## CVE-2026-43284 & CVE-2026-43500 — "Dirty Frag" Kernel LPEs (High)
GHES 3.20.3 also ships an updated bundled Linux kernel that fixes two high-severity local privilege-escalation flaws collectively branded "Dirty Frag" — one in the IPsec ESP (XFRM) subsystem (CVE-2026-43284) and one in the RxRPC networking subsystem (CVE-2026-43500). The Dirty Frag family of bugs abuses fragmentation/coalescing logic in the kernel networking path to drive an out-of-bounds page-cache write, allowing a local unprivileged user with shell access on the appliance to corrupt kernel memory and gain root.
In the GHES context this is most dangerous on multi-tenant or large-team appliances where multiple internal users, CI runners, or automated processes have shell access (admin shell, support-bundle generation contexts, scripted maintenance). A low-privileged foothold (e.g. an attacker who chained the SSRF, leveraged a separate webshell, or compromised a legitimate operator account) can be reliably escalated to root, granting full control over the underlying OS, the entire Git data set, all repository secrets, and all customer source code stored on the appliance.
## CVE-2026-5921 & CVE-2026-8606 — Additional Hardening
GHES 3.20.3 also rolls in fixes carried over from earlier 3.20.x updates: a timing side-channel in the notebook viewer that could leak environment variables to an attacker (CVE-2026-5921), and an internal packages endpoint that could be abused for unauthenticated SSRF when private mode is disabled (CVE-2026-8606). Both were reported through the GitHub Bug Bounty program.
## GPG Signing Key Rotation (Operational Hard Gate)
As part of this release, GitHub has revoked the previous GPG signing key for GHES release packages and signed 3.20.3 (and all subsequent images) with a new key. Administrators must run GitHub's official key-rotation script/procedure to install the new trusted public key on every appliance before attempting the 3.20.3 upgrade. Skipping the rotation step will cause the appliance's signature verification to fail and the upgrade to be blocked — delaying deployment of the SSRF and kernel LPE fixes.
## Operational Impact and Recommended Posture
Any GHES appliance reachable from a less-trusted network is at risk of pre-auth SSRF exploitation; if shell access is shared by multiple teams, the chained SSRF -> credential theft -> remote authenticated foothold -> kernel LPE -> root path is realistic. GitHu
Weaknesses (CWE)
CWE-918, CWE-20, CWE-787, CWE-119, CWE-203, CWE-200, CWE-269
Target sectors: technology, financial, government, defense, healthcare, manufacturing, telecommunications, education, energy
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-08-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-9312, CVE-2026-43284, CVE-2026-43500, CVE-2026-5921, CVE-2026-8606, T1595, T1590, T1587, T1190, T1078, T1203, T1059, T1098, T1543, T1068
