CVE-2026-0573

What it is

An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens. The repository_pages API insecurely followed HTTP redirects when fetching artifact URLs, preserving the authorization header containing a privileged JWT. An authenticated user could redirect these requests to an attacker-controlled domain, exfiltrate the Actions.ManageOrgs JWT, and leverage it for potential remote code execution. Attackers would require access to the target GitHub Enterprise Server instance and the ability to exploit a legacy redirect to an attacker-controlled domain. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.19 and was fixed in versions 3.19.2, 3.18.4, 3.17.10, 3.16.13, 3.15.17, and 3.14.22. This vulnerability was reported via the GitHub Bug Bounty program.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. High risk of data exposure, data tampering.

Exploit odds

0.7% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-02-18 21:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 10:10 UTC Last updatedMost recent change to the record

Details

Published

2026-02-18 21:16 UTC

Last modified

2026-06-17 10:10 UTC

Exploit probability

0.7% · EPSS, next 30 days

Weakness

CWE-601

Record status

Analyzed

Affected

• GitHub Enterprise Server < 3.14.22
• GitHub Enterprise Server < 3.15.17
• GitHub Enterprise Server < 3.16.13
• GitHub Enterprise Server < 3.17.10
• GitHub Enterprise Server < 3.18.4
• GitHub Enterprise Server < 3.19.2

Attack profile CVSS 4.0 · 7.6

Attack vector

Network

Complexity

Low

Attack requirements

Present

Privileges needed

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

None