CVE-2026-9106: GitHub Enterprise Server OAuth Scope Misrepresentation Vulnerability

Technical summary

CVE-2026-9106 is a UI misrepresentation flaw in GitHub Enterprise Server's OAuth authorization flow. The manage_runners:org scope was not rendered on the consent screen presented to users authorizing third-party applications. An attacker could craft an OAuth app requesting this scope and socially engineer a victim into approving authorization, resulting in the application gaining unintended access to organization runner management functions. The vulnerability stems from incomplete scope disclosure (CWE-451: User Interface Misrepresentation of Critical Information) and requires both the attacker to create a malicious OAuth app and a user to authorize it, making exploitation dependent on social engineering rather than a direct technical attack.

Business impact

Organization runners are critical infrastructure for CI/CD automation. Unauthorized access to runner management could allow an attacker to modify runner configurations, inject malicious jobs, access runner secrets, or disrupt build pipelines. The scope of impact is limited to users who authorize the malicious OAuth application, but a successful breach could compromise the integrity of software delivery for affected organizations. The risk is heightened for organizations using runners for sensitive deployments or where supply chain integrity is critical.

Affected systems

GitHub Enterprise Server versions prior to 3.22 are affected. Patches are available for: 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, and 3.16.20. Organizations on unsupported versions (3.15 and earlier) cannot receive patches and should prioritize upgrade planning. The vulnerability affects any user who authorizes an OAuth application on an unpatched instance.

Exploitability

Exploitation requires two steps: (1) attacker creates an OAuth application requesting the manage_runners:org scope, and (2) attacker socially engineers a target user to authorize the application. Because the scope was not displayed, users had no warning they were granting runner management access. The attack is not remotely exploitable without user interaction, making it moderate in difficulty but highly feasible via phishing or supply chain tactics. No public exploit code or active exploitation has been reported.

Remediation

Apply the appropriate security patch immediately: identify your current GitHub Enterprise Server version and upgrade to the corresponding patched release (3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, or 3.16.20 depending on your version line). Organizations on end-of-life versions should plan an upgrade to a supported release. After patching, review authorized OAuth applications within your organization, revoke any untrusted or unfamiliar applications, and audit runner access logs for unauthorized modifications.

Patch guidance

Patches are available across six version lines. Verify your current GitHub Enterprise Server version via the management console or CLI. Consult the official GitHub Enterprise Server release notes to confirm the exact patch version for your line and apply it following your standard change management procedures. Patches should be tested in a non-production environment before broad deployment. Organizations unable to patch immediately should restrict OAuth application authorizations and monitor runner activity closely.

Detection guidance

Review the list of authorized OAuth applications in your organization (Organization Settings > Developer Settings > OAuth Apps). Look for unfamiliar applications, especially those with authorization timestamps coinciding with unexpected user activity. Audit GitHub Enterprise Server logs for unusual runner modifications, failed job executions, or configuration changes. If you detect suspicious activity, revoke the application's access immediately and review the runner's access history and recent job logs. Consider implementing policies that restrict which users can authorize OAuth applications.

Why prioritize this

This vulnerability merits prompt but measured attention. The CVSS 3.1 score of 5.5 (MEDIUM) reflects the requirement for user interaction and limited scope, but the business impact is significant: runner compromise could lead to supply chain attacks or secrets exposure. The vulnerability is not in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no documented active exploitation at time of publication. Organizations should prioritize patching based on the sensitivity of their CI/CD infrastructure and the likelihood of social engineering attacks within their user base.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects: Network-accessible attack vector (AV:N) with low attack complexity (AC:L), requiring authenticated access (PR:L) and user interaction (UI:R). Impact is limited to confidentiality, integrity, and availability of runner-related functions (C:L/I:L/A:L) within a single organizational scope (S:U). The score appropriately captures that while the vulnerability is easily exploitable via social engineering, its impact is scoped to users who authorize the malicious application and the systems it can control. However, the business risk may exceed the numerical score for organizations with sensitive CI/CD pipelines.

Frequently asked questions