Gitlab Gitlab vulnerabilities

CVE-2025-14871 High · 7.5 CWE-770 Sep 16, 2026

Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.

CVE-2026-85706 Critical · 10.0 KEV Urgent · 83 Public exploit CWE-22 Sep 12, 2026

GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

CVE-2026-75871 Critical · 9.6 CWE-918 Aug 27, 2026

Server-Side Request Forgery (SSRF) in Gitlab

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an externally-controlled endpoint via a crafted inline flow configuration that overrides the HTTP Host header, resulting in disclosure of Google Cloud Vertex cloud service credentials and private signing keys.

CVE-2026-7487 Low · 3.5 CWE-1280 Aug 26, 2026

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before…

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due to improper authorization checks.

CVE-2026-77801 Medium · 6.5 CWE-770 Aug 26, 2026

Allocation of Resources Without Limits or Throttling in Gitlab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing object count limits.

CVE-2026-3035 Medium · 5.5 CWE-288 Aug 26, 2026

Authentication Bypass Using an Alternate Path or Channel in Gitlab

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were not authorized to use due to improper authorization checks.

CVE-2026-18252 High · 8.1 CWE-829 Aug 26, 2026

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before…

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude agent processing configuration from a user-controlled source.

CVE-2026-15387 Medium · 4.3 CWE-349 Aug 26, 2026

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before…

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have influenced the execution environment of Pipeline Execution Policy enforcement jobs, due to improper handling of job dependencies.

CVE-2025-10903 Medium · 6.5 CWE-835 Aug 26, 2026

Infinite Loop in Gitlab

GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have caused denial of service, due to an unbounded loop triggered by specially crafted input in the SCIM user provisioning feature.

CVE-2026-10053 High · 8.8 CWE-22 Aug 23, 2026

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package registry.

CVE-2026-19650 High · 7.1 CWE-352 Aug 17, 2026

Cross-Site Request Forgery (CSRF) in Gitlab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling.

CVE-2026-19478 Critical · 9.1 CWE-94 Aug 17, 2026

Code Injection in Gitlab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.

CVE-2026-6821 Medium · 4.3 CWE-862 Aug 12, 2026

Missing Authorization in Gitlab

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a private project due to missing authorization checks in a merge requests API endpoint.

CVE-2026-4879 Medium · 4.3 CWE-862 Aug 12, 2026

Missing Authorization in Gitlab

GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to higher-privileged roles due to missing authorization on a merge request API endpoint.

CVE-2026-19228 High · 8.5 CWE-639 Aug 12, 2026

Authorization Bypass Through User-Controlled Key (IDOR) in Gitlab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests.

CVE-2026-18433 Medium · 4.3 CWE-863 Aug 12, 2026

Incorrect Authorization in Gitlab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect authorization checks in a GraphQL query.

CVE-2026-16494 High · 7.1 CWE-862 Aug 12, 2026

Missing Authorization in Gitlab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint.

CVE-2026-15217 High · 8.7 CWE-79 Aug 12, 2026

Cross-site Scripting (XSS) in Gitlab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component.

CVE-2026-15216 High · 8.7 CWE-79 Aug 12, 2026

Cross-site Scripting (XSS) in Gitlab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component.

CVE-2025-9486 Low · 3.3 CWE-266 Aug 12, 2026

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before…

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege assignment that did not account for membership state.

CVE-2026-8667 Medium · 4.3 CWE-863 Aug 12, 2026

Incorrect Authorization in Gitlab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required maintainer-level permissions due to improper authorization checks.

CVE-2026-7427 High · 7.5 CWE-770 Aug 12, 2026

Allocation of Resources Without Limits or Throttling in Gitlab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper input validation.

CVE-2026-18244 Medium · 4.3 CWE-862 Aug 12, 2026

Missing Authorization in Gitlab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group settings page.

CVE-2026-16627 Critical · 9.0 CWE-79 Aug 12, 2026

Cross-site Scripting (XSS) in Gitlab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal.

CVE-2026-15423 High · 8.5 CWE-863 Aug 12, 2026

Incorrect Authorization in Gitlab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation.