Rumors City

Search this site

GitHub Added Webhook IP Ranges: Check Your Allowlist

Posted byJustin SooPublished 2 minutes read

Does your server accept GitHub webhooks only from approved IP addresses? Three new network ranges could matter to your firewall.

On October 29, 2026, GitHub announced three additional CIDR blocks for webhook deliveries on github.com. If you maintain a manually configured allowlist, check it before valid deliveries start getting rejected.

The three new GitHub webhook ranges

9.234.98.160/28
9.234.98.176/28
9.234.106.48/28

These ranges are additions, not replacements. GitHub says they apply to webhook deliveries from github.com across its plans, including Enterprise Cloud. The announcement does not say to apply them to a self-hosted GitHub Enterprise Server.

Check the current list in one command

GitHub publishes its current network ranges through the public Meta API. On a machine with curl and jq installed, use:

curl -fsSL -H 'Accept: application/vnd.github+json' https://api.github.com/meta | jq -r '.hooks[]'

This reads the hooks array, which is the field for webhook delivery networks. It is a read-only inspection command; it does not update your firewall.

Who needs to do something?

  • Static allowlist: compare your current rules with the live hooks list, then add missing ranges using your normal firewall or reverse-proxy change process.
  • Automatically refreshed allowlist: GitHub says no change is needed for these additions, provided your synchronization is working.
  • No IP filtering: this specific update does not require a firewall change, but review your webhook security controls.

Do not treat an IP allowlist as authentication

GitHub recommends HTTPS, a secret token, and validation of the X-Hub-Signature-256 header before processing a webhook. Verify the HMAC against the original request body with a constant-time comparison. An allowed IP address alone cannot prove a payload is authentic.

If a CDN or proxy sits in front of your endpoint, confirm which client IP your firewall actually sees before changing rules. Never blindly trust an unverified forwarded-IP header.

Quick takeaway

Review static webhook allowlists today, use the live Meta API as your source of truth, and keep signature verification enabled. GitHub can change its IP ranges again, so a periodically reviewed or automated allowlist is safer than a forgotten hard-coded list.

Sources