GitHub Enterprise Server notebook viewer SSRF validates scheme/host but not port, letting attackers probe internal services on other appliance ports. No response body is returned, but timing acts as an oracle to extract instance secrets, then use an internal service to achieve RCE. Affects 3.17–3.22. Upgrade to 3.22.1 (or 3.21.6/3.20.8/3.19.12/3.18.15/3.17.21) to mitigate.