CVE-2026-8106 Cross-site scripting in Enterprise Server

Medium 5.9 Published 7 May 2026 Updated 8 May 2026

Reflected HTML injection in the login page allows attackers to steal administrator credentials via crafted links.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-8106?

CVE-2026-8106 is a medium-severity cross-site scripting vulnerability in Github Enterprise Server, published on 7 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page that could allow credential theft. The redirect_to query parameter on the /setup/unlock endpoint was reflected into an HTML attribute without proper sanitization, enabling an attacker to inject a form element that could capture administrator credentials. Exploitation required an administrator to click a crafted link and enter their credentials. This vulnerability affected GitHub Enterprise Server versions 3.19.1 through 3.19.5 and 3.20.0 through 3.20.1, and was fixed in versions 3.19.6 and 3.20.2. This vulnerability was reported via the GitHub Bug Bounty program.

Weakness: CWE-79

Which versions are affected by CVE-2026-8106?

It affects 1 product.

Products include Github Enterprise Server.

How do I fix CVE-2026-8106?

No fix has been published for CVE-2026-8106 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-8106 being exploited?

There is no known exploitation of CVE-2026-8106 in the wild and no public exploit code.

All Github Enterprise Server vulnerabilities

Sources

Also known as GHSA-xqmx-3vx6-fm88.