« Volver al listado

CVE-2026-0573

Estado: AnalizadaAlta (7.6)—

An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens. The repository_pages API insecurely followed HTTP redirects when fetching artifact URLs, preserving the authorization header containing a privileged JWT. An authenticated user could redirect these requests to an attacker-controlled domain, exfiltrate the Actions.ManageOrgs JWT, and leverage it for potential remote code execution.

Leer descripción completaMostrar menos

Attackers would require access to the target GitHub Enterprise Server instance and the ability to exploit a legacy redirect to an attacker-controlled domain. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.19 and was fixed in versions 3.19.2, 3.18.4, 3.17.10, 3.16.13, 3.15.17, and 3.14.22. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de redirección de URL (CWE-601) en servicio remoto autenticado (PR:L, AV:N) que filtra tokens JWT privilegiados para acceso remoto; requiere autenticación pero sin interacción del usuario en la explotación.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Application Developer GuidanceThreat Intelligence ProgramPrivileged Account ManagementApplication Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (1)

Github — Enterprise Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-0573",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-0573",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-18T21:18:26.120107Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "product-cna@github.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7.6,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "product-cna@github.com",
      "affectedData": [
        {
          "vendor": "GitHub",
          "product": "Enterprise Server",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.14.22",
                  "status": "unaffected"
                }
              ],
              "version": "3.14",
              "versionType": "semver",
              "lessThanOrEqual": "3.14.21"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.15.17",
                  "status": "unaffected"
                }
              ],
              "version": "3.15",
              "versionType": "semver",
              "lessThanOrEqual": "3.15.16"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.16.13",
                  "status": "unaffected"
                }
              ],
              "version": "3.16",
              "versionType": "semver",
              "lessThanOrEqual": "3.16.12"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.17.10",
                  "status": "unaffected"
                }
              ],
              "version": "3.17",
              "versionType": "semver",
              "lessThanOrEqual": "3.17.9"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.18.4",
                  "status": "unaffected"
                }
              ],
              "version": "3.18",
              "versionType": "semver",
              "lessThanOrEqual": "3.18.3"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.19.2",
                  "status": "unaffected"
                }
              ],
              "version": "3.19",
              "versionType": "semver",
              "lessThanOrEqual": "3.19.1"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-02-18T21:16:22.470",
  "references": [
    {
      "url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.22",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "product-cna@github.com"
    },
    {
      "url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.17",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "product-cna@github.com"
    },
    {
      "url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.13",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "product-cna@github.com"
    },
    {
      "url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.10",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "product-cna@github.com"
    },
    {
      "url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.4",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "product-cna@github.com"
    },
    {
      "url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.2",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "product-cna@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "product-cna@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens. The repository_pages API insecurely followed HTTP redirects when fetching artifact URLs, preserving the authorization header containing a privileged JWT. An authenticated user could redirect these requests to an attacker-controlled domain, exfiltrate the Actions.ManageOrgs JWT, and leverage it for potential remote code execution. Attackers would require access to the target GitHub Enterprise Server instance and the ability to exploit a legacy redirect to an attacker-controlled domain. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.19 and was fixed in versions 3.19.2, 3.18.4, 3.17.10, 3.16.13, 3.15.17, and 3.14.22. This vulnerability was reported via the GitHub Bug Bounty program."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de redirección de URL fue identificada en GitHub Enterprise Server la cual permitía a las redirecciones controladas por el atacante filtrar tokens de autorización sensibles. La API repository_pages seguía de forma insegura las redirecciones HTTP al obtener URLs de artefactos, preservando el encabezado de autorización que contenía un JWT privilegiado. Un usuario autenticado podía redirigir estas solicitudes a un dominio controlado por el atacante, exfiltrar el JWT de Actions.ManageOrgs y aprovecharlo para una posible ejecución remota de código. Los atacantes requerirían acceso a la instancia de GitHub Enterprise Server objetivo y, también, la capacidad de explotar una redirección heredada a un dominio controlado por el atacante. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server anteriores a la 3.19 y fue corregida en las versiones 3.19.2, 3.18.4, 3.17.10, 3.16.13, 3.15.17 y 3.14.22. Esta vulnerabilidad fue reportada a través del programa GitHub Bug Bounty."
    }
  ],
  "lastModified": "2026-06-17T10:10:58.443",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B364775-45E7-4E82-8C8D-DBCD513523C3",
              "versionEndExcluding": "3.14.22"
            },
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44763502-3158-4369-9EBB-8D87C16645FC",
              "versionEndExcluding": "3.15.17",
              "versionStartIncluding": "3.15.0"
            },
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3E68ACE-C628-4029-B7B4-1E08D502A24D",
              "versionEndExcluding": "3.16.13",
              "versionStartIncluding": "3.16.0"
            },
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "062A4133-114C-4643-BB73-1C37C0C188C6",
              "versionEndExcluding": "3.17.10",
              "versionStartIncluding": "3.17.0"
            },
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "51E739B5-F9CF-4D7E-8240-FEE7E3D9F1A2",
              "versionEndExcluding": "3.18.4",
              "versionStartIncluding": "3.18.0"
            },
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D8AE9F21-7596-446E-99B8-F09A230F173A",
              "versionEndExcluding": "3.19.2",
              "versionStartIncluding": "3.19.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "product-cna@github.com"
}