GitLab GitLab Version Control Server

Known Exploited GitLab Vulnerabilities

The following GitLab vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

The vulnerability CVE-2023-7028: GitLab Community and Enterprise Editions Improper Access Control Vulnerability is in the top 1% of the currently known exploitable vulnerabilities. 2 known exploited GitLab vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 88 vulnerabilities in GitLab with an average score of 6.0 out of ten. Last year, in 2025 GitLab had 162 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in GitLab in 2026 could surpass last years number. Last year, the average CVE base score was greater by 0.10

Recent GitLab Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-3254	Apr 22, 2026	GitLab CE/EE 18.11: Auth User Load Unauth Content via Mermaid Sandbox GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user to load unauthorized content into another user's browser due to improper input validation in the Mermaid sandbox.	GitLab
CVE-2026-4922	Apr 22, 2026	GitLab unauth GraphQL CSRF (v < 18.9.6 / 18.10.4 / 18.11.1) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.	GitLab
CVE-2025-0186	Apr 22, 2026	GitLab CE/EE DoS via crafted endpoint (v10.6-18.9.5/18.10-18.10.3/18.11-18.11.0) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service under certain conditions by exhausting server resources by making crafted requests to a discussions endpoint.	GitLab
CVE-2025-3922	Apr 22, 2026	GitLab CE/EE DoS via GraphQL API before 18.9.6, 18.10.4, 18.11.1 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.4 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service by overwhelming system resources under certain conditions due to insufficient resource allocation limits in the GraphQL API.	GitLab
CVE-2025-6016	Apr 22, 2026	GitLab CE/EE Auth DoS via Notes Retrieval before 18.11.1 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service due to insufficient resource allocation limits when retrieving notes under certain conditions.	GitLab
CVE-2025-9957	Apr 22, 2026	Auth Bypass via Group Fork Prevention in GitLab CE/EE 11.2+ to 18.11.1 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user with project owner permissions to bypass group fork prevention settings due to improper authorization checks.	GitLab
CVE-2026-1660	Apr 22, 2026	GitLab CE/EE DoS from Issue Import Input Validation up to 18.11.1 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user to cause denial of service when importing issues due to improper input validation.	GitLab
CVE-2026-5262	Apr 22, 2026	GitLab <=18.11.1 Storybook token disclosure to unauthenticated user GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.1.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an unauthenticated user to access tokens in the Storybook development environment due to improper input validation.	GitLab
CVE-2026-5377	Apr 22, 2026	GitLab <=18.11.1 Improper ACL in Issue Render GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that could have allowed an authenticated user to access titles of confidential or private issues in public projects due to improper access control in the issue description rendering process.	GitLab
CVE-2026-5816	Apr 22, 2026	GitLab CE/EE XSS via Path Validation (18.10<18.10.4, 18.11<18.11.1) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.4 and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session due to improper path validation under certain conditions.	GitLab
CVE-2026-6515	Apr 22, 2026	GitLab Virtual Registry Credential Escalation 18.218.11.1 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed a user to use invalidated or incorrectly scoped credentials to access Virtual Registries under certain conditions.	GitLab
CVE-2025-9484	Apr 08, 2026	GitLab EE Authenticated GraphQL Email Disclosure CVE-2025-9484 (v16.6-18.9.4) GitLab has remediated an issue in GitLab EE affecting all versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user to have access to other users' email addresses via certain GraphQL queries.	GitLab
CVE-2025-12664	Apr 08, 2026	GitLab 13.0-18.10.3 GraphQL DoS via repeated queries GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service by sending repeated GraphQL queries.	GitLab
CVE-2026-1092	Apr 08, 2026	GitLab CE/EE 12.10-18.10 DoS via JSON Validation GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service due to improper input validation of JSON payloads.	GitLab
CVE-2026-1101	Apr 08, 2026	GitLab EE Authenticated GraphQL DoS (18.218.10) GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to cause denial of service to the GitLab instance due to improper input validation in GraphQL queries.	GitLab
CVE-2026-1516	Apr 08, 2026	GitLab EE <=18.10.3 Authenticated IP Leak via Code Quality Reports GitLab has remediated an issue in GitLab EE affecting all versions from 18.0.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that in Code Quality reports could have allowed an authenticated user to leak IP addresses of users viewing the report via specially crafted content.	GitLab
CVE-2026-1752	Apr 08, 2026	GitLab EE Auth Bypass v11.318.8.9, v18.918.9.5, v18.1018.10.3 GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with developer-role permissions to modify protected environment settings due to improper authorization checks in the API.	GitLab
CVE-2026-2104	Apr 08, 2026	GitLab CE/EE Auth Bypass for CSV Export of Confidential Issues (v18.2-18.10) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to access confidential issues assigned to other users via CSV export due to insufficient authorization checks.	GitLab
CVE-2026-2619	Apr 08, 2026	GitLab EE Priv Escal: Auditor edits vuln data (v18.6-18.8.9,18.9-18.9.5,18.10-18.10.3) GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user with auditor privileges to modify vulnerability flag data in private projects due to incorrect authorization.	GitLab
CVE-2026-4332	Apr 08, 2026	GitLab EE 18.2-18.10 XSS in Analytics Dashboards (before 18.8.9/18.9.5/18.10.3) GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.	GitLab
CVE-2026-4916	Apr 08, 2026	GitLab CE/EE Privilege Escalation 18.2-18.8.8, 18.9-18.9.4, 18.10-18.10.2 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with custom role permissions to demote or remove higher-privileged group members due to improper authorization checks on member management operations.	GitLab
CVE-2026-5173	Apr 08, 2026	GitLab WebSocket IAC 16.9.6-18.10.3 (CVE-2026-5173) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to invoke unintended server-side methods through websocket connections due to improper access control.	GitLab
CVE-2026-2370	Mar 29, 2026	GitLab Improper Auth Jira Connect creds leak v14.318.8.6/18.918.9.2 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions to obtain installation credentials and impersonate the GitLab app due to improper authorization checks.	GitLab
CVE-2025-13078	Mar 25, 2026	GitLab CE/EE <=18.10.1 DoS via excessive webhook config (CVE-2025-13078) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to cause a denial of service due to excessive resource consumption when processing certain webhook configuration inputs.	GitLab
CVE-2025-13436	Mar 25, 2026	GitLab CE/EE before 18.10.1: Authenticated CI Input DoS via Resource Exhaustion GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to cause a denial of service due to excessive resource consumption when handling certain CI-related inputs.	GitLab
CVE-2025-14595	Mar 25, 2026	GitLab EE <=18.10.1 Improper Access Control (Planner) CVE-2025-14595 GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user with Planner role to view security category metadata and attributes in group security configuration due to improper access control	GitLab
CVE-2026-1724	Mar 25, 2026	GitLab EE API Token Leak via ACL flaw in 18.5-18.8.7, 18.9-18.9.3, 18.10-18.10.1 GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to access API tokens of self-hosted AI models due to improper access control.	GitLab
CVE-2026-2745	Mar 25, 2026	GitLab WebAuthn 2FA Bypass (unauth) fixed in 18.8.7/18.9.3/18.10.1 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 7.11 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to bypass WebAuthn two-factor authentication and gain unauthorized access to user accounts due to inconsistent input validation in the authentication process.	GitLab
CVE-2026-2726	Mar 25, 2026	GitLab 18.10.1 Auth Bypass in Merge Request Access Control (CVE-2026-2726) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to perform unauthorized actions on merge requests in other projects due to improper access control during cross-repository operations.	GitLab
CVE-2026-2973	Mar 25, 2026	GitLab CE/EE <18.8.7/18.9.3/18.10.1: Auth Hijack XSS via Mermaid Diagrams GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to execute arbitrary JavaScript in a user's browser due to improper sanitization of entity-encoded content in Mermaid diagrams.	GitLab
CVE-2026-2995	Mar 25, 2026	GitLab EE 15.4-18.8.x Auth Email Add via Bad HTML Sanitization GitLab has remediated an issue in GitLab EE affecting all versions from 15.4 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to add email addresses to targeted user accounts due to improper sanitization of HTML content.	GitLab
CVE-2026-3857	Mar 25, 2026	GitLab CE/EE CSRF Enables Arbitrary GraphQL Mutations (v17.1018.10) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.	GitLab
CVE-2026-3988	Mar 25, 2026	GitLab 18.518.8.7 / 18.918.9.3 / 18.1018.10.1 GraphQL DoS (unauth) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance unresponsive due to improper input validation in GraphQL request processing.	GitLab
CVE-2026-4363	Mar 25, 2026	GitLab EE Improper Auth Caching (18.118.10.1) Enables Privilege Escalation GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user to gain unauthorized access to resources due to improper caching of authorization decisions.	GitLab
CVE-2026-1182	Mar 12, 2026	GitLab Unauthorized Issue Title Exposure (<=18.7.5, <=18.8.5, <=18.9.1) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.14 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to gain unauthorized access to confidential issue title created in public projects under certain circumstances.	GitLab
CVE-2025-12555	Mar 11, 2026	GitLab CE/EE auth bypass, pipeline info disclosure <18.7.6/18.8.6/18.9.2 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that, under certain conditions, could have allowed an authenticated user to access previous pipeline job information on projects with repository and CI/CD disabled due to improper authorization checks.	GitLab
CVE-2025-12576	Mar 11, 2026	GitLab CE/EE Webhook DOs (<18.7.6, <18.8.6, <18.9.2) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.3 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that under certain conditions could have allowed an authenticated user to cause a denial of service due to improper handling of webhook response data.	GitLab
CVE-2025-12697	Mar 11, 2026	GitLab CE/EE <=18.9.2 Exposes Datadog API Credentials (Maintainer Auth) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.5 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user with maintainer-role permissions to reveal Datadog API credentials under certain conditions.	GitLab
CVE-2025-12704	Mar 11, 2026	GitLab EE: Improper Auth to Access Virtual Registry before 18.7.6 / 18.8.6 / 18.9.2 GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to access Virtual Registry data in groups where they are not members due to improper authorization under certain conditions.	GitLab
CVE-2025-13690	Mar 11, 2026	GitLab DoS via webhook custom headers (v16.11-18.9) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to cause a denial of service condition due to improper input validation on webhook custom header names under certain conditions.	GitLab
CVE-2025-13929	Mar 11, 2026	GitLab DoS via archive endpoint requests 10.0-18.9.2 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by issuing specially crafted requests to repository archive endpoints under certain conditions.	GitLab
CVE-2025-14513	Mar 11, 2026	GitLab Unauth DOS via JSON Payloads v18.7.6/18.8.6/18.9.2 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service condition due to improper input validation when processing specially crafted JSON payloads in the protected branches API.	GitLab
CVE-2026-0602	Mar 11, 2026	GitLab CE/EE Metadata Disclosure via Snippet Rendering (15.6-18.9.2) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to disclose metadata from private issues, merge requests, epics, milestones, or commits due to improper filtering in the snippet rendering process under certain circumstances.	GitLab
CVE-2026-1069	Mar 11, 2026	GitLab GraphQL Recursion DoS (CE/EE) <18.9.2 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by sending specially crafted GraphQL requests due to uncontrolled recursion under certain circumstances.	GitLab
CVE-2026-1090	Mar 11, 2026	Authenticated XSS via markdown_placeholders in GitLab CE/EE (v10.618.9.2) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user, when the `markdown_placeholders` feature flag was enabled, to inject JavaScript in a browser due to improper sanitization of placeholder content in markdown processing.	GitLab
CVE-2026-1230	Mar 11, 2026	GitLab CE/EE: Authenticated Repo Download Code Divergence (before 18.9.2) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 1.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to cause repository downloads to contain different code than displayed in the web interface due to incorrect validation of branch references under certain circumstances.	GitLab
CVE-2026-1663	Mar 11, 2026	GitLab CE/EE Grp Imp Auth Allows Label Creation in Priv. Projects (v14.418.9) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user with group import permissions to create labels in private projects due to improper authorization validation in the group import process under certain circumstances.	GitLab
CVE-2026-1732	Mar 11, 2026	GitLab CE/EE Auth Discovery Vulnerability (12.6-18.9.x) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to disclose confidential issue titles due to improper filtering under certain circumstances.	GitLab
CVE-2026-3848	Mar 11, 2026	GitLab CE/EE: Authenticated Proxy Request via Import (18.7.6/18.8.6/18.9.2) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to make unintended internal requests through proxy environments under certain conditions due to improper input validation in import functionality.	GitLab
CVE-2025-14511	Feb 25, 2026	GitLab CE/EE Denial of Service via Registry Event Endpoint (<=18.9.1) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted files to the container registry event endpoint under certain conditions.	GitLab