CVE-2026-0573: GitHub Enterprise Server Open Redirect Leaks Authorization Token

Overview

CVE-2026-0573 is an open redirect weakness (CWE-601) in GitHub Enterprise Server. According to the record, the repository_pages API followed HTTP redirects when fetching artifact URLs and carried over the authorization header, which contained a privileged JWT. The details below rely on the record's description, and the vendor release notes linked here name the fixed versions by branch.

Impact

• Per the record, an authenticated user could cause the server to send its authorization token to a domain the attacker controls.
• The exposed token is described as the Actions.ManageOrgs JWT, which the record says could be leveraged for potential remote code execution.
• The NVD CVSS base score is 9 (critical). The GitHub CNA score is 7.6 under CVSS 4.0. These scores are reported as recorded and were not independently verified here.
• The record lists SSVC exploitation as none and automatable as no.

Affected products and versions

• Product: GitHub Enterprise Server.
• Affected ranges in the record: from 3.14 up to and including 3.14.21, from 3.15 up to and including 3.15.16, from 3.16 up to and including 3.16.12, from 3.17 up to and including 3.17.9, from 3.18 up to and including 3.18.3, and from 3.19 up to and including 3.19.1.
• The narrative description states that all versions before 3.19 were affected. The branch-specific ranges are more granular, so administrators should check the vendor advisory to reconcile the two statements.
• Fixed versions: 3.14.22, 3.15.17, 3.16.13, 3.17.10, 3.18.4 and 3.19.2.

Exploitation status

• The CISA KEV catalog does not list this CVE according to the record.
• No confirmed exploitation appears in the sources consulted. The record gives an EPSS probability of 0.00736 and a percentile of 0.5397.

Remediation and mitigation

• Upgrade each GitHub Enterprise Server instance to the fixed version of its release branch, following the vendor release notes such as 3.19.2 release notes.
• Prioritize instances where many users hold authenticated access, since the record states that an authenticated user is required.
• After upgrading, consider rotating credentials and tokens that may have been exposed on instances that were running affected versions. This is an inference from the nature of the flaw, not a vendor instruction in the record.
• Check the NVD entry for updates.

Detection guidance

• Review server logs and audit records for unexpected outbound requests from the appliance to external domains during artifact retrieval.
• Watch for unusual use of Actions-related privileged tokens from unexpected sources.
• These are high-level suggestions. The record does not describe specific indicators of compromise.

Limitations of the available information

• The record provides no proof of concept and no detailed exploitation conditions, and this analysis does not add any.
• The narrative version statement and the per-branch version ranges differ in granularity.
• The record's fixes list is empty, which does not mean no fix exists, because the release notes name fixed versions.
• Whether any specific deployment was exploited is unknown from these sources.

Frequently asked questions

What is CVE-2026-0573?

It is an open redirect weakness in GitHub Enterprise Server, where the repository_pages API followed redirects and sent an authorization token along, according to the record.

Which versions are fixed?

The record lists fixes in 3.14.22, 3.15.17, 3.16.13, 3.17.10, 3.18.4 and 3.19.2, one for each release branch.

Is this vulnerability known to be exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.