CVE-2026-0573 Open redirect in Enterprise Server

High 7.6 Published 18 Feb 2026 Updated 18 Feb 2026

An open redirect in GitHub Enterprise Server allows authenticated users to leak authorization tokens, potentially leading to remote code execution.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-0573?

CVE-2026-0573 is a high-severity vulnerability in Github Enterprise Server, published on 18 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens. The repository_pages API insecurely followed HTTP redirects when fetching artifact URLs, preserving the authorization header containing a privileged JWT. An authenticated user could redirect these requests to an attacker-controlled domain, exfiltrate the Actions.ManageOrgs JWT, and leverage it for potential remote code execution. Attackers would require access to the target GitHub Enterprise Server instance and the ability to exploit a legacy redirect to an attacker-controlled domain. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.19 and was fixed in versions 3.19.2, 3.18.4, 3.17.10, 3.16.13, 3.15.17, and 3.14.22. This vulnerability was reported via the GitHub Bug Bounty program.

Weakness: CWE-601

Which versions are affected by CVE-2026-0573?

It affects 1 product.

Products include Github Enterprise Server.

How do I fix CVE-2026-0573?

No fix has been published for CVE-2026-0573 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-0573 being exploited?

There is no known exploitation of CVE-2026-0573 in the wild and no public exploit code.

All Github Enterprise Server vulnerabilities

Sources

Also known as GHSA-p546-7whm-cxpm.