CVE-2026-110288: Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Console
A cross-site request forgery vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete stored Slack and Microsoft Teams ChatOps configuration and provider credentials by inducing an authenticated Management Console operator's browser to send a cross-site GET request to the integration removal endpoint without a CSRF token. Exploitation required configured ChatOps integrations and an operator visiting attacker-controlled content while signed in to the Management Console; deletion could disrupt ChatOps notifications and commands when configuration was applied or services reloaded. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.23 and was fixed in versions 3.19.14, 3.20.10, 3.21.8, and 3.22.3. This vulnerability was reported via the GitHub Bug Bounty program.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
GitHub Enterprise Server deployments running a version earlier than 3.23 are affected. Exploitation also depends on Slack or Microsoft Teams ChatOps integrations being configured and an authenticated Management Console operator being present.
What must an attacker do to exploit the vulnerability?
The attacker must induce a signed-in Management Console operator to visit attacker-controlled content. That content causes the operator's browser to issue a cross-site GET request to the integration removal endpoint; the attacker does not need to authenticate to the Management Console.
What is the practical impact of a successful attack?
An attacker can delete stored Slack and Microsoft Teams ChatOps configuration and provider credentials. ChatOps notifications and commands can be disrupted when the changed configuration is applied or services are reloaded.
Which versions contain the fix?
Fixes are available in GitHub Enterprise Server 3.19.14, 3.20.10, 3.21.8, and 3.22.3. Versions prior to 3.23 are identified as affected.