GitLab GitLab Version Control Server

Known Exploited GitLab Vulnerabilities

The following GitLab vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

The vulnerability CVE-2023-7028: GitLab Community and Enterprise Editions Improper Access Control Vulnerability is in the top 1% of the currently known exploitable vulnerabilities. 2 known exploited GitLab vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 196 vulnerabilities in GitLab with an average score of 5.9 out of ten. Last year, in 2025 GitLab had 162 security vulnerabilities published. That is, 34 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.22

Recent GitLab Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-12910	Sep 15, 2026	GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to bypass SAML SSO sign-in restrictions and authenticate without SSO due to missing authentication enforcement checks.	GitLab
CVE-2026-13210	Sep 15, 2026	GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input validation in the environment scope pattern matcher.	GitLab
CVE-2026-82837	Sep 15, 2026	GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could have allowed an authenticated user to access sensitive credentials and tokens without transiting the expected proxy due to improper authorization checks on internal data emission endpoints.	GitLab
CVE-2026-88765	Sep 15, 2026	GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicode conversion buffer used in Advanced Search indexing.	GitLab
CVE-2026-85706	Sep 12, 2026	GitLab File Read via Unauth Repo Commits API (18.7-19.3.x) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.	GitLab
CVE-2026-87719	Sep 12, 2026	GitLab EE Advanced Search Leak via GraphQL sub (v18.3-<19.1.8,19.2-<19.2.6,19.3-<19.3.2) GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.	GitLab
CVE-2026-4398	Aug 27, 2026	GitLab EE <19.3.1: Missing Namespace Validation Enables Auth User Assignment GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have assigned compliance frameworks from namespaces they were not authorized to access to their own project, due to missing namespace validation on self-managed instances.	GitLab
CVE-2026-75871	Aug 27, 2026	GitLab AI Gateway Auth Bypass via Host Header Override (18.10-19.2.2) GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an externally-controlled endpoint via a crafted inline flow configuration that overrides the HTTP Host header, resulting in disclosure of Google Cloud Vertex cloud service credentials and private signing keys.	Ai Gateway
CVE-2026-19889	Aug 27, 2026	GitLab AI Gateway Auth Bypass via External Endpoint Redirect (18.9.0-19.2.2) GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect model requests to an externally-controlled endpoint via crafted model metadata, resulting in the disclosure of Google Vertex AI or AWS Bedrock cloud service credentials.	Ai Gateway
CVE-2025-10903	Aug 26, 2026	GitLab EE SCIM User Provisioning DoS via Unbounded Loop (19.1.7/19.2.5/19.3.1) GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have caused denial of service, due to an unbounded loop triggered by specially crafted input in the SCIM user provisioning feature.	GitLab
CVE-2026-3035	Aug 26, 2026	GitLab EE Auth Bypass in Protected Env <19.1.7/19.2.5/19.3.1 Improper Authorization GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were not authorized to use due to improper authorization checks.	GitLab
CVE-2026-7487	Aug 26, 2026	GitLab EE Auth Escalation: Reset MR Approval Rules (v13.1v19.3.1) GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due to improper authorization checks.	GitLab
CVE-2026-15387	Aug 26, 2026	GitLab EE 19.x Auth Dev-Role Pipeline Exec Policy Bypass via Job Deps GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have influenced the execution environment of Pipeline Execution Policy enforcement jobs, due to improper handling of job dependencies.	GitLab
CVE-2026-18252	Aug 26, 2026	GitLab Cmd Exec in CI via Claude AG v18.9-<19.1.7,19.2-<19.2.5,19.3-<19.3.1 GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude agent processing configuration from a user-controlled source.	GitLab
CVE-2026-77801	Aug 26, 2026	GitLab CE/EE Auth Denial-of-Service via Missing Object Count Limits v12.8-19.3 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing object count limits.	GitLab
CVE-2026-10053	Aug 23, 2026	GitLab CE/EE RCE via pkg reg Path Traversal (ver <19.1.4) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package registry.	GitLab
CVE-2026-19650	Aug 17, 2026	GitLab v18.2-18.11.10, v19.0-19.0.7, v19.1-19.1.5, v19.2-19.2.3 Unauth GET GraphQL Mut Exec GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling.	GitLab
CVE-2026-19478	Aug 17, 2026	GitLab CE/EE <18.11.11, 19.0.0-<19.0.8 allow unauthenticated GraphQL override GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.	GitLab
CVE-2025-9486	Aug 12, 2026	Privilege Escalation in GitLab EE via Pending Membership (15.6-19.2) GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege assignment that did not account for membership state.	GitLab
CVE-2026-4879	Aug 12, 2026	GitLab EE Auth Bypass: Dev view of External Status Check via MR API (v1619) GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to higher-privileged roles due to missing authorization on a merge request API endpoint.	GitLab
CVE-2026-6821	Aug 12, 2026	GitLab EE IP Bypass via Merge Request API v12.0-19.2.2 GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a private project due to missing authorization checks in a merge requests API endpoint.	GitLab
CVE-2026-15217	Aug 12, 2026	GitLab CE/EE <=19.2.2 XSS in Analytics Dashboard Table Cells GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component.	GitLab
CVE-2026-15216	Aug 12, 2026	GitLab <19.0.6 <19.1.4 <19.2.2 XSS in Analytics Pagination GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component.	GitLab
CVE-2026-16494	Aug 12, 2026	GitLab EE 19.x Auth checks lost - allowed modify project settings GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint.	GitLab
CVE-2026-18433	Aug 12, 2026	GitLab EE <=19.1.3 & <=19.2.1 GraphQL Auth Bypass unauthorized policy read GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect authorization checks in a GraphQL query.	GitLab
CVE-2026-19228	Aug 12, 2026	GitLab EE AI Attribution Auth Bypass 19.1-<19.1.4, 19.2-<19.2.2 GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests.	GitLab
CVE-2026-7427	Aug 12, 2026	GitLab CE/EE Unauth DoS via Input Validation before 19.2.2 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper input validation.	GitLab
CVE-2026-8667	Aug 12, 2026	GitLab CE/EE authz flaw: Dev can alter pkg metadata < v19.2.2 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required maintainer-level permissions due to improper authorization checks.	GitLab
CVE-2026-15423	Aug 12, 2026	GitLab 19.x Improper Auth: Dev Role Triggers CI/CD on Protected Branch GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation.	GitLab
CVE-2026-16627	Aug 12, 2026	GitLab 19.2 Priv Escalation via CI Job Modal HTML Sanitization (Before 19.2.2) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal.	GitLab
CVE-2026-18244	Aug 12, 2026	Auth Bypass: GitLab EE 17.719.2.2 Restricted Config Leak GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group settings page.	GitLab
CVE-2025-14562	Jul 29, 2026	GitLab CE/EE auth bypass via MR collaboration settings, before 19.2.1 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to commit changes to a project after being removed as a member, due to improper authorization checks on merge request collaboration settings.	GitLab
CVE-2026-3093	Jul 29, 2026	GitLab JavaScript XSS via crafted URL (v14.019.2.1) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper sanitization of user-controlled input.	GitLab
CVE-2026-4672	Jul 29, 2026	GitLab Access Control Bypass in test reports CE/EE 18.4-19.2.1 (CVE-2026-4672) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with guest-role permissions to access test report contents they were not authorized to view due to improper access control enforcement.	GitLab
CVE-2026-6267	Jul 29, 2026	GitLab CE/EE <=19.0.5 Dev Access Info Disclosure via Internal Requests GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access controls on internal request handling.	GitLab
CVE-2026-6336	Jul 29, 2026	Unauthorized Access: GitLab CE/EE v16.6-19.2.1 Project Import Disclosure GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthorized user to view project import source information due to a missing authorization check.	GitLab
CVE-2026-12436	Jul 29, 2026	GitLab CE/EE <19.0.5/19.1.3/19.2.1 CI/CD Config Escalation via Pipeline Schedule GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of user-supplied attributes when processing pipeline schedule inputs.	GitLab
CVE-2026-13113	Jul 29, 2026	GitLab EE Merge race (pre-19.0.5) allows approvals bypass GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to merge code into a protected branch without the required approvals due to a race condition in approval rule processing.	GitLab
CVE-2026-14341	Jul 29, 2026	GitLab API Auth Bypass: Maintainer Can Alter Protected Branches v12.819.2 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Maintainer role to modify protected branch configuration due to improper authorization in a projects API endpoint.	GitLab
CVE-2026-14351	Jul 29, 2026	GitLab CE/EE 8.819.2.1 Unauth Issue Title Leak via MR GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to view the title of a confidential issue through a publicly accessible merge request due to improper authorization checks.	GitLab
CVE-2026-15077	Jul 29, 2026	GitLab EE Unauthorized Data Leak via AI Code Review (v19.1<19.1.3 & 19.2<19.2.1) GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to access information from unauthorized projects due to improper neutralization of untrusted content processed by the AI-assisted code review functionality.	GitLab
CVE-2026-15831	Jul 29, 2026	GitLab EE Auth Bypass in Token Generation (19.1 < 19.1.3, 19.2 < 19.2.1) GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to bypass administrator-configured tool governance policies due to improper authorization enforcement during token generation.	GitLab
CVE-2026-15975	Jul 29, 2026	GitLab CE/EE 19.0.5/19.1<3.3 Unauth DoS via MR Discussions GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to insufficient resource throttling when processing merge request discussions.	GitLab
CVE-2026-16553	Jul 29, 2026	GitLab EE Virtual Reg Info Disclosure (18.819.2) GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed some sensitive information to be disclosed to an unintended host due to improper handling of upstream requests in virtual registries.	GitLab
CVE-2025-12506	Jul 08, 2026	GitLab Repo Creation Web-Download Mismatch via Improper Git Ref (18.11.7) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to create a repository where the content displayed in the web interface differed from the content available for download, due to improper handling of Git reference name resolution.	GitLab
CVE-2026-6352	Jul 08, 2026	GitLab EE Auth Bypass: Auditors can alter compliance records via GraphQL GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with auditor-level access to modify compliance violation records due to improper authorization on certain GraphQL operations.	GitLab
CVE-2026-6896	Jul 08, 2026	GitLab EE: Arbitrary Script Exec via XSS in EE <18.11.7,<19.0.4,<19.1.2 GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.	GitLab
CVE-2026-7492	Jul 08, 2026	GitLab <=18.11.6 Unauth Detect Private Projects via Cross-Project Ref check GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.1 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an unauthenticated user to determine the existence of a private project due to improper authorization controls on cross-project reference pages.	GitLab
CVE-2026-8472	Jul 08, 2026	Auth Bypass: GitLab EE 18.9-18.11.7/19.0-19.0.4/19.1-19.1.2 Reading Metadata GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with minimal access permissions to read work item metadata from private projects due to missing authorization checks.	GitLab
CVE-2026-11827	Jul 08, 2026	GitLab EE Auth Bypass: Maintainer Can Read Stored Credentials (v<18.11.7, 19.0<19.0.4, 19.1<19.1.2) GitLab has remediated an issue in GitLab EE affecting all versions from 9.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to obtain another user's stored credentials due to improper authorization controls.	GitLab