---METADATA---
VENDOR: GitLab
PRODUCT: GitLab EE
AFFECTED_VERSIONS: 16.4 up to 18.9.7, 18.10 up to 18.10.6, 18.11 up to 18.11.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Cross-Site Scripting (XSS) vulnerability exists in GitLab EE, allowing authenticated users to inject malicious scripts into web pages viewed by other users.

Executive Summary:
A critical Cross-Site Scripting (XSS) vulnerability in GitLab EE allows authenticated attackers to execute malicious scripts in the context of other users' sessions.

Vulnerability Details

CVE-ID: CVE-2026-7481

Affected Software: GitLab EE

Affected Versions: 16.4 up to 18.9.7, 18.10 up to 18.10.6, 18.11 up to 18.11.3

Vulnerability: This is a stored or reflected Cross-Site Scripting (CWE-79) vulnerability. It requires a low-privileged authenticated user to interact with the application, potentially leading to session hijacking or sensitive data theft when the payload is triggered by a victim.

Business Impact

An XSS attack can lead to the theft of session tokens, unauthorized actions performed on behalf of legitimate users, and the potential exposure of sensitive repository data. With a CVSS score of 8.7, the impact on integrity and confidentiality is substantial, particularly in environments where high-privilege administrators interact with the platform.

Remediation Plan

Immediate Action: Upgrade GitLab EE to versions 18.9.7, 18.10.6, 18.11.3, or higher to remediate the vulnerability.

Proactive Monitoring: Review web access logs for suspicious input patterns and monitor for unusual activity associated with administrative accounts.

Compensating Controls: Ensure that Content Security Policy (CSP) headers are strictly configured to mitigate the impact of script injection attacks.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in our curated sources.

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk remains high due to the nature of XSS in collaborative development environments.

Analyst Recommendation

GitLab instances are high-value targets for supply chain and intellectual property theft. Administrators should treat this update with high priority and apply the patches during the next available maintenance window to protect against potential XSS-based attacks.

---METADATA---
VENDOR: GitLab
PRODUCT: GitLab EE
AFFECTED_VERSIONS: 18.7.0 up to (excluding) 18.9.7, 18.10.0 up to (excluding) 18.10.6, 18.11.0 up to (excluding) 18.11.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
GitLab EE is vulnerable to a Stored Cross-site Scripting (XSS) issue, allowing authenticated users to inject malicious scripts into web pages.

Executive Summary:
A Cross-site Scripting (XSS) vulnerability in GitLab EE could allow an authenticated attacker to execute arbitrary scripts in the context of other users' sessions.

Vulnerability Details

CVE-ID: CVE-2026-7377

Affected Software: GitLab EE

Affected Versions: 18.7.0 up to (excluding) 18.9.7, 18.10.0 up to (excluding) 18.10.6, 18.11.0 up to (excluding) 18.11.3

Vulnerability: This is a Cross-site Scripting (CWE-79) vulnerability where improper neutralization of user-supplied input allows an authenticated attacker with low privileges to execute malicious scripts.

Business Impact

A successful exploit could lead to session hijacking, unauthorized actions performed on behalf of other users, or the exfiltration of sensitive data. With a CVSS score of 8.7 (High), this vulnerability presents a significant risk to the integrity and confidentiality of the GitLab environment, particularly for administrators or high-privilege users targeted by the script.

Remediation Plan

Immediate Action: Upgrade GitLab EE instances to versions 18.9.7, 18.10.6, 18.11.3, or higher immediately.

Proactive Monitoring: Monitor web access logs for unusual patterns or payloads containing script tags associated with user-controlled input fields.

Compensating Controls: Implement or tune a Web Application Firewall (WAF) to detect and block common XSS attack patterns targeting the GitLab interface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the CVSS score is 8.7, the requirement for authenticated access mitigates the risk of external, unauthenticated mass-exploitation.

Analyst Recommendation

Given the potential for session compromise within high-value development environments, patching is critical. Organizations should prioritize updating their GitLab installations to the versions provided to ensure complete remediation of this XSS flaw.

---METADATA---
VENDOR: GitLab
PRODUCT: GitLab EE
AFFECTED_VERSIONS: 13.11 up to 18.11.7, 19.0 up to 19.0.4, 19.1 up to 19.1.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
GitLab EE is vulnerable to a stored Cross-Site Scripting (XSS) attack, allowing authenticated users to inject malicious scripts into web pages viewed by other users.

Executive Summary:
A stored Cross-Site Scripting vulnerability in GitLab EE allows authenticated attackers to execute malicious scripts in the context of other users' browser sessions.

Vulnerability Details

CVE-ID: CVE-2026-6896

Affected Software: GitLab GitLab EE

Affected Versions: 13.11 up to 18.11.7, 19.0 up to 19.0.4, 19.1 up to 19.1.2

Vulnerability: The application fails to properly neutralize user-supplied input (CWE-79), resulting in an XSS vulnerability. An authenticated attacker can exploit this to execute arbitrary JavaScript in the victim's browser.

Business Impact

With a CVSS score of 8.7, this vulnerability poses a severe threat to session security and data integrity. An attacker could hijack user sessions, steal session tokens, or perform actions on behalf of authenticated users, including high-privilege accounts, potentially leading to unauthorized repository access.

Remediation Plan

Immediate Action: Upgrade GitLab EE to versions 18.11.7, 19.0.4, 19.1.2, or higher as specified by the vendor.

Proactive Monitoring: Review audit logs for suspicious activity or anomalous script injections within merge requests or issue comments.

Compensating Controls: Enforce strict Content Security Policy (CSP) headers to restrict the sources from which scripts can be executed, mitigating the impact of XSS.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk of session hijacking via XSS is significant for development environments. Security teams should deploy the provided patches immediately to protect user accounts and the integrity of the GitLab instance.

---METADATA---
VENDOR: GitLab
PRODUCT: GitLab EE
AFFECTED_VERSIONS: GitLab EE: all versions from 15.5 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2
---END_METADATA---

Description Summary:
An improper authorization flaw in Group SAML identity management allows authenticated group owners to perform account takeovers of other group members.

Executive Summary:
A critical authorization vulnerability in GitLab EE has been observed in the wild, allowing authenticated group owners to compromise the accounts of other group members.

Vulnerability Details

CVE-ID: CVE-2026-6552

Affected Software: GitLab, GitLab EE

Affected Versions: GitLab EE: all versions from 15.5 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2

Vulnerability: The vulnerability stems from an improper authorization flaw within the Group SAML identity management functionality. It allows an authenticated user with a group Owner role to manipulate identity associations, enabling the takeover of another group member's account.

Business Impact

With a CVSS score of 8.7, this flaw poses a severe risk to organizational identity and access management. Because this vulnerability has been confirmed as exploited in the wild, the threat to business continuity and data integrity is immediate, potentially allowing attackers to bypass standard authentication controls and gain unauthorized access to proprietary intellectual property.

Remediation Plan

Immediate Action: Patch all affected GitLab EE installations to version 19.0.2, 18.11.5, or 18.10.8 immediately.

Proactive Monitoring: Monitor SAML authentication logs and group membership changes for suspicious modifications or unauthorized identity linking activities.

Compensating Controls: Restrict "Owner" role permissions to a minimal set of trusted administrators until the patch is successfully applied to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 12, 2026, this vulnerability has been exploited in the wild. Given the confirmed active exploitation, this must be treated as a high-priority security incident.

Analyst Recommendation

This vulnerability represents an active and critical threat to your environment. Administrators should verify if any unauthorized SAML identity modifications have occurred in their audit logs and apply the recommended security updates without delay to prevent further exploitation.

---METADATA---
VENDOR: GitLab
PRODUCT: GitLab CE/EE
AFFECTED_VERSIONS: 10.1.0 up to 19.0.5, 19.1.0 up to 19.1.3, 19.2.0 up to 19.2.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
GitLab CE and EE contain an insertion of sensitive information into sent data vulnerability, allowing authenticated users to access unauthorized information.

Executive Summary:
GitLab has addressed a critical information disclosure vulnerability in the CE and EE editions that allows authenticated users to access restricted data.

Vulnerability Details

CVE-ID: CVE-2026-6267

Affected Software: GitLab CE/EE

Affected Versions: 10.1.0 up to 19.0.5, 19.1.0 up to 19.1.3, 19.2.0 up to 19.2.1

Vulnerability: This vulnerability involves the improper insertion of sensitive information into sent data (CWE-201), which can be exploited by an authenticated attacker to gain unauthorized access to sensitive information.

Business Impact

This vulnerability is assigned a CVSS score of 8.5, indicating a high risk of sensitive data exposure. Unauthorized access to internal information within a development environment can lead to intellectual property theft, credential compromise, and severe reputational damage to the organization.

Remediation Plan

Immediate Action: Upgrade all instances of GitLab CE/EE to version 19.0.5, 19.1.3, 19.2.1, or higher immediately.

Proactive Monitoring: Audit access logs for unusual patterns of data retrieval or unexpected API calls originating from low privileged user accounts.

Compensating Controls: If immediate patching is not possible, restrict access to the GitLab instance to trusted internal networks and enforce strict session management policies.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof of concept for this vulnerability. The vulnerability is limited to authenticated users, which reduces the potential attack surface compared to unauthenticated flaws.

Analyst Recommendation

Organizations should treat this update with high priority due to the sensitive nature of the data stored within GitLab environments. Applying the provided updates is the most effective way to secure the environment against this information disclosure risk.

---METADATA---
VENDOR: zereight
PRODUCT: mcp-gitlab
AFFECTED_VERSIONS: 0 up to (excluding) 2.1.18
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The zereight mcp-gitlab package is susceptible to a path traversal vulnerability in the job_id parameter, enabling attackers to access arbitrary files on the system.

Executive Summary:
A path traversal vulnerability in zereight mcp-gitlab allows unauthenticated attackers to read sensitive files from the host system, posing a critical risk to system confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-61462

Affected Software: zereight mcp-gitlab

Affected Versions: 0 up to (excluding) 2.1.18

Vulnerability: This is a path traversal vulnerability (CWE-73) within the job_id parameter of the build/index function. It allows unauthenticated remote attackers to bypass directory restrictions and access files outside of the intended directory.

Business Impact

The CVSS score of 8.6 highlights the severity of this flaw, as it permits unauthorized file disclosure. Successful exploitation could allow an attacker to read sensitive configuration files, environment variables, or other private data stored on the filesystem, potentially leading to a full system compromise.

Remediation Plan

Immediate Action: Update the mcp-gitlab package to version 2.1.18 or later, which includes the necessary fix for the path traversal issue.

Proactive Monitoring: Inspect server logs for requests containing path traversal sequences (e.g., ../) targeting the build/index endpoint.

Compensating Controls: Configure file system permissions to follow the principle of least privilege, ensuring the application process cannot access sensitive files outside of its working directory.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable via direct web requests.

Analyst Recommendation

This path traversal vulnerability is a significant security concern due to its potential for unauthorized file access without authentication. Users of mcp-gitlab should treat the update to version 2.1.18 as a high-priority task to ensure the integrity and confidentiality of their infrastructure.

---METADATA---
VENDOR: GitLab
PRODUCT: GitLab EE
AFFECTED_VERSIONS: 18.7 up to 18.9.7, 18.10 up to 18.10.6, 18.11 up to 18.11.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
GitLab EE is affected by a Cross-site Scripting (XSS) vulnerability that allows for improper neutralization of input during web page generation.

Executive Summary:
A stored cross-site scripting (XSS) vulnerability in GitLab EE may allow authenticated, low-privileged users to execute arbitrary scripts in the context of a victim's session.

Vulnerability Details

CVE-ID: CVE-2026-6073

Affected Software: GitLab GitLab EE

Affected Versions: 18.7 up to 18.9.7, 18.10 up to 18.10.6, 18.11 up to 18.11.3

Vulnerability: This is a Cross-site Scripting (CWE-79) vulnerability where insufficient input validation allows an authenticated user to inject malicious scripts, potentially compromising other user sessions.

Business Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, leading to session hijacking, unauthorized data access, or the performance of actions on behalf of the victim. With a CVSS score of 8.7, this represents a high risk to the confidentiality and integrity of the GitLab environment, particularly for organizations relying on GitLab for CI/CD and source code management.

Remediation Plan

Immediate Action: Upgrade GitLab EE instances to versions 18.9.7, 18.10.6, 18.11.3 or higher immediately.

Proactive Monitoring: Monitor audit logs for unusual web requests or suspicious activity originating from accounts with low-level privileges.

Compensating Controls: Ensure Content Security Policy (CSP) headers are strictly configured to mitigate the impact of potential script injection attacks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires a low-privileged user to interact with the application, making it a significant risk for internal environments.

Analyst Recommendation

Given the CVSS score of 8.7, this vulnerability should be treated as a high-priority update. Administrators must verify their current GitLab version and apply the identified patches immediately to prevent unauthorized access and potential account takeovers.

---METADATA---
VENDOR: GitLab
PRODUCT: GitLab EE
AFFECTED_VERSIONS: 18.8 up to 18.10.7, 18.11 up to 18.11.4, 19.0 up to 19.0.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
GitLab EE contains an authorization bypass vulnerability allowing authenticated users to perform actions via user-controlled keys.

Executive Summary:
An authorization bypass vulnerability in GitLab EE may allow authenticated users to perform unauthorized actions, necessitating an immediate upgrade to the provided patched versions.

Vulnerability Details

CVE-ID: CVE-2026-4868

Affected Software: GitLab GitLab EE

Affected Versions: 18.8 up to 18.10.7, 18.11 up to 18.11.4, 19.0 up to 19.0.1

Vulnerability: This is an Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability. It requires low-privileged authenticated access to exploit, potentially permitting users to interact with resources they are not authorized to access.

Business Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive project repositories, metadata, or administrative functions within the GitLab instance. The CVSS score of 8.2 reflects the high risk of unauthorized access and potential data compromise in a collaborative development environment.

Remediation Plan

Immediate Action: Upgrade GitLab EE installations to version 18.10.7, 18.11.4, 19.0.1, or higher immediately.

Proactive Monitoring: Review audit logs and access logs for suspicious activity or unauthorized attempts to access protected resources during the period before the patch was applied.

Compensating Controls: Restrict access to the GitLab instance to trusted networks and ensure that the Principle of Least Privilege is enforced for all user accounts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability's reliance on user-controlled keys makes it a targeted risk for environments with diverse user roles.

Analyst Recommendation

The severity of this authorization bypass necessitates prompt action. Administrators must prioritize the application of the vendor-supplied security updates to ensure the integrity and confidentiality of the GitLab environment.

---METADATA---
VENDOR: GitLab
PRODUCT: GitLab
AFFECTED_VERSIONS: 18.2 up to (excluding) 18.11.11, 19.0 up to (excluding) 19.0.8, 19.1 up to (excluding) 19.1.6, 19.2 up to (excluding) 19.2.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A code injection vulnerability in GitLab allows unauthenticated remote attackers to modify or delete public projects and user data via a malicious GraphQL directive.

Executive Summary:
An unauthenticated code injection vulnerability in GitLab allows remote attackers to manipulate project and user data, presenting a critical risk to platform integrity.

Vulnerability Details

CVE-ID: CVE-2026-19478

Affected Software: GitLab CE/EE

Affected Versions: 18.2 up to (excluding) 18.11.11, 19.0 up to (excluding) 19.0.8, 19.1 up to (excluding) 19.1.6, 19.2 up to (excluding) 19.2.4

Vulnerability: This is an Improper Control of Generation of Code (CWE-94) vulnerability. It enables an unauthenticated attacker to execute unauthorized actions against public projects and user data by leveraging a specific GraphQL directive.

Business Impact

With a CVSS score of 9.4, this vulnerability is extremely severe as it allows unauthenticated remote access to modify or destroy project data. This could result in catastrophic data loss, unauthorized alteration of source code, and reputational damage. The ability to target user data further elevates the risk to the privacy and security of all platform participants.

Remediation Plan

Immediate Action: Upgrade GitLab to versions 18.11.11, 19.0.8, 19.1.6, 19.2.4, or later immediately.

Proactive Monitoring: Review audit logs for unexpected GraphQL queries or suspicious API activity originating from unauthorized or external IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to filter and block malicious GraphQL directives or unexpected API requests that target project management endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature and the high level of control it grants over project data.

Analyst Recommendation

This vulnerability is critical and requires immediate attention to prevent unauthorized data modification. GitLab administrators must apply the provided patches across all affected instances without delay to secure their environments against potential remote exploitation.

---METADATA---
VENDOR: GitLab
PRODUCT: AI Gateway (Duo Workflow Service)
AFFECTED_VERSIONS: 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0
---END_METADATA---

Description Summary:
Insecure template expansion in GitLab AI Gateway allows attackers to cause a denial-of-service or execute arbitrary code via crafted Duo Agent definitions.

Executive Summary:
A critical vulnerability in the GitLab AI Gateway Duo Workflow Service permits remote code execution or denial-of-service via insecure template expansion.

Vulnerability Details

CVE-ID: CVE-2026-1868

Affected Software: GitLab AI Gateway

Affected Versions: 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0

Vulnerability: The AI Gateway component is vulnerable to insecure template expansion of user-supplied data through crafted Duo Agent Platform Flow definitions. An attacker can leverage this flaw to inject malicious code that the Gateway processes, leading to either a total system crash or arbitrary code execution.

Business Impact

A successful exploit could lead to the complete compromise of the AI Gateway, potentially exposing sensitive AI training data or integration secrets. The CVSS score of 9.9 indicates a near-maximum severity, reflecting the catastrophic potential for service downtime and unauthorized access to the underlying infrastructure.

Remediation Plan

Immediate Action: Update the GitLab AI Gateway to versions 18.6.2, 18.7.1, or 18.8.1 immediately.

Proactive Monitoring: Monitor the AI Gateway logs for unusual Duo Agent Platform Flow definitions or unexpected service restarts.

Compensating Controls: Ensure that the AI Gateway is deployed within a segmented network environment to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 9, 2026, there is no public information indicating active exploitation. GitLab has proactively released patches, and the high CVSS score necessitates urgent attention from security teams.

Analyst Recommendation

Because this vulnerability allows for remote code execution on a high-value AI component, remediation should be the highest priority. Administrators must update to the fixed versions (18.6.2, 18.7.1, or 18.8.1) immediately to mitigate the risk of exploitation.

---METADATA---
VENDOR: GitLab
PRODUCT: GitLab
AFFECTED_VERSIONS: 18.2 up to 19.0.6, 19.1 up to 19.1.4, 19.2 up to 19.2.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A cross-site scripting vulnerability in GitLab CE/EE allows an authenticated attacker to execute arbitrary malicious scripts in the context of a victim's session.

Executive Summary:
A high-severity cross-site scripting vulnerability in GitLab CE/EE could allow an authenticated attacker to compromise user sessions and perform unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2026-15217

Affected Software: GitLab CE/EE

Affected Versions: 18.2 up to 19.0.6, 19.1 up to 19.1.4, 19.2 up to 19.2.2

Vulnerability: This vulnerability is a cross-site scripting (XSS) flaw, classified as CWE-79, resulting from improper input neutralization. An authenticated attacker can exploit this weakness to execute scripts in the browser of other users, potentially leading to unauthorized data exposure or account manipulation.

Business Impact

The vulnerability carries a CVSS score of 8.7, reflecting a high risk to the confidentiality and integrity of the platform. Successful exploitation allows for the execution of arbitrary code in a victim's browser, which can result in the theft of session tokens or the performance of unauthorized actions on behalf of the user. This poses a significant risk of data exfiltration and loss of trust in the development infrastructure.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates by upgrading to version 19.0.6, 19.1.4, 19.2.2, or later.

Proactive Monitoring: Monitor user activity logs for suspicious interactions or injected content that deviates from standard platform usage.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common XSS attack patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires an authenticated session, but it remains a critical concern for multi-user environments.

Analyst Recommendation

It is imperative that administrators apply the available patches to all affected GitLab instances. Given the high-severity rating, organizations should treat this update as a priority to prevent potential session hijacking and unauthorized access.

---METADATA---
VENDOR: GitLab
PRODUCT: GitLab
AFFECTED_VERSIONS: 18.2 up to 19.0.6, 19.1 up to 19.1.4, 19.2 up to 19.2.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A cross-site scripting vulnerability exists in GitLab CE/EE that allows a logged-in user to execute arbitrary scripts in the context of the victim's session.

Executive Summary:
A high-severity cross-site scripting vulnerability in GitLab CE/EE could allow an authenticated attacker to compromise user sessions and perform unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2026-15216

Affected Software: GitLab CE/EE

Affected Versions: 18.2 up to 19.0.6, 19.1 up to 19.1.4, 19.2 up to 19.2.2

Vulnerability: This vulnerability is a stored cross-site scripting (XSS) flaw, identified as CWE-79, which occurs due to improper neutralization of input during web page generation. An attacker with low-level privileges can leverage this flaw to execute malicious scripts when a victim interacts with the affected component.

Business Impact

Successful exploitation allows an attacker to manipulate the user interface or steal sensitive information by executing scripts within the victim's browser session. Given the CVSS score of 8.7, this flaw poses a significant risk to organizational data integrity and session security. Unauthorized actions performed by an attacker could lead to account takeover or the exfiltration of private repository data.

Remediation Plan

Immediate Action: Upgrade all instances of GitLab CE/EE to version 19.0.6, 19.1.4, 19.2.2, or higher immediately.

Proactive Monitoring: Review application access logs for unusual patterns or suspicious script injections originating from authenticated user sessions.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts within the browser environment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires an authenticated user, the impact on integrity and confidentiality is substantial.

Analyst Recommendation

Organizations running the affected versions of GitLab should prioritize applying the provided security patches. Given the potential for session compromise, immediate remediation is required to maintain the security posture of the development environment.

---METADATA---
VENDOR: GitLab
PRODUCT: GitLab CE/EE
AFFECTED_VERSIONS: 18.0 up to 19.0.5, 19.1 up to 19.1.3, 19.2 up to 19.2.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
GitLab CE/EE is vulnerable to an improper control of object attributes, allowing an authenticated user to perform unauthorized modifications.

Executive Summary:
A vulnerability in GitLab CE/EE allows authenticated users to manipulate object attributes, potentially leading to unauthorized system changes or privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-12436

Affected Software: GitLab CE/EE

Affected Versions: 18.0 up to 19.0.5, 19.1 up to 19.1.3, 19.2 up to 19.2.1

Vulnerability: This issue is an improper control of dynamically determined object attributes (CWE-915). It requires an authenticated user to successfully exploit the flaw.

Business Impact

The vulnerability carries a CVSS score of 8.4, reflecting a high severity risk. Successful exploitation could allow a malicious actor to modify system objects, potentially resulting in unauthorized administrative access, data integrity loss, or significant service disruption within the GitLab environment.

Remediation Plan

Immediate Action: Upgrade GitLab installations to versions 19.0.5, 19.1.3, 19.2.1, or later immediately.

Proactive Monitoring: Review audit logs for suspicious configuration changes or unexpected modifications to project or user attributes.

Compensating Controls: Implement strict access control lists and principle of least privilege to limit the impact of compromised accounts until patching is complete.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of the attack vector is high, but the potential for total technical impact necessitates prompt remediation.

Analyst Recommendation

Given the high CVSS score and the nature of the vulnerability, administrators should prioritize updating their GitLab instances. Applying the vendor-supplied patches is the only reliable way to neutralize this risk.

---METADATA---
VENDOR: GitLab
PRODUCT: GitLab EE
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
GitLab EE contains a security vulnerability in versions 19 and later that necessitates an immediate update.

Executive Summary:
GitLab EE is susceptible to a high-severity vulnerability in versions 19 and later, which could lead to unauthorized actions and compromise of development infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-12053

Affected Software: GitLab GitLab EE

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability exists within the GitLab EE platform and requires an authenticated session to execute. The flaw allows for potential security bypasses that could impact the confidentiality and integrity of the platform.

Business Impact

A successful exploit of this vulnerability could result in the exposure of proprietary code and sensitive CI/CD secrets. Based on the CVSS score of 8.6, this is a major security concern that could lead to widespread reputational damage and the loss of sensitive development data if left unpatched.

Remediation Plan

Immediate Action: Update all instances of GitLab EE to the latest version recommended by the vendor.

Proactive Monitoring: Monitor system logs for unusual authentication patterns or unauthorized API calls that deviate from standard developer behavior.

Compensating Controls: Utilize network-level access controls to restrict access to the GitLab interface to known, trusted IP ranges while the patching process is underway.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations must treat this vulnerability with high priority. The potential for unauthorized access to development pipelines makes immediate patching the only viable strategy to ensure the integrity of the software supply chain. Please consult the official GitLab security advisory for the specific patch version and deployment instructions.

---METADATA---
VENDOR: GitLab
PRODUCT: GitLab EE
AFFECTED_VERSIONS: GitLab EE: all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2
---END_METADATA---

Description Summary:
A stored cross-site scripting (XSS) vulnerability in the Analytics Dashboard allows authenticated developers to execute malicious code in the context of other users.

Executive Summary:
A high-severity stored cross-site scripting vulnerability in GitLab EE allows authenticated attackers to execute arbitrary code, leading to potential account takeover.

Vulnerability Details

CVE-ID: CVE-2026-10087

Affected Software: GitLab, GitLab EE

Affected Versions: GitLab EE: all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2

Vulnerability: This vulnerability involves improper input sanitization within the Analytics Dashboard, which allows an authenticated user with developer-role permissions to inject malicious client-side code. This code executes in the context of a targeted user, facilitating session hijacking and unauthorized actions.

Business Impact

The vulnerability carries a CVSS score of 8.7, reflecting a high risk to organizational security. Successful exploitation could lead to full account takeover, unauthorized access to sensitive repository data, and potential privilege escalation within the development environment, resulting in significant reputational and operational damage.

Remediation Plan

Immediate Action: Upgrade all instances of GitLab EE to version 19.0.2, 18.11.5, or 18.10.8 as appropriate for your current deployment branch.

Proactive Monitoring: Review application access logs and audit trails for anomalous activity originating from the Analytics Dashboard or unexpected script executions by user accounts.

Compensating Controls: Implement a strict Content Security Policy (CSP) and ensure a Web Application Firewall (WAF) is configured to detect and block common XSS injection patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for complete account compromise and lateral movement within the development pipeline, administrators must prioritize this patch. Apply the vendor-provided security updates immediately to mitigate the risk of malicious code injection and unauthorized session access.

---METADATA---
VENDOR: GitLab
PRODUCT: GitLab EE
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
GitLab EE is affected by a security vulnerability requiring immediate remediation to prevent unauthorized system access.

Executive Summary:
GitLab EE contains a high-severity vulnerability in versions 16 and later that poses a significant risk to the security and integrity of the CI/CD pipeline.

Vulnerability Details

CVE-ID: CVE-2026-10086

Affected Software: GitLab GitLab EE

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the GitLab EE platform and requires authenticated access to exploit. It involves a security flaw that could lead to unauthorized actions within the GitLab environment.

Business Impact

The exploitation of this vulnerability could lead to unauthorized access to repositories, environment variables, and sensitive configuration data. With a CVSS score of 8.7, this vulnerability presents a significant risk to intellectual property and development workflows, potentially allowing an attacker to inject malicious code into software build pipelines.

Remediation Plan

Immediate Action: Apply the latest security patches provided by GitLab immediately to remediate the vulnerability.

Proactive Monitoring: Review audit logs for anomalous user activity, particularly unauthorized changes to repository settings or project configurations.

Compensating Controls: Enforce strict access control policies and ensure that multi-factor authentication (MFA) is enabled for all users to minimize the impact of credential-based exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of GitLab in the software development lifecycle, it is imperative to apply the vendor-supplied security updates without delay. Security teams should verify that all GitLab instances are running the most recent patched version to ensure continued protection against unauthorized access.

Executive Summary:
A high-severity vulnerability has been identified in the Kiro IDE, which could allow an attacker to take control of a developer's workstation. By tricking a user into opening a project with a specially crafted folder name, an attacker can execute arbitrary commands on the system. This could lead to data theft, malware installation, or further intrusion into the corporate network.

Vulnerability Details

CVE-ID: CVE-2026-0830

Affected Software: before Multiple Products

Affected Versions: All versions before version 0. See vendor advisory for specific affected versions.

Vulnerability: This is an arbitrary command injection vulnerability within the Kiro GitLab Merge-Request helper component of the Kiro IDE. The vulnerability is triggered when the IDE processes a workspace folder with a specially crafted name containing malicious commands. An attacker can exploit this by convincing a user to clone and open a malicious repository or project. When the helper utility processes the folder name, it fails to properly sanitize the input before passing it to a system shell, allowing the embedded commands to be executed with the permissions of the user running the IDE.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.8. Successful exploitation allows an attacker to execute arbitrary commands on an affected developer's workstation. The potential consequences include theft of sensitive intellectual property such as source code, API keys, and internal credentials; installation of malware, spyware, or ransomware; and using the compromised machine as a pivot point for lateral movement into the broader corporate network. This poses a significant risk to data confidentiality, integrity, and the overall security of the development environment.

Remediation Plan

Immediate Action: Apply the security updates provided by the vendor immediately to patch the vulnerability. Following the update, monitor systems for any signs of exploitation attempts by reviewing application and system access logs for suspicious activity.

Proactive Monitoring: Security teams should monitor for suspicious child processes being spawned by the Kiro IDE process (e.g., cmd.exe, powershell.exe, /bin/sh, /bin/bash). Monitor endpoint detection and response (EDR) logs for unusual file modifications or network connections originating from the IDE. Scrutinize network traffic for unexpected outbound connections from developer workstations to unknown destinations.

Compensating Controls: If immediate patching is not feasible, consider implementing the following controls:

• Use application control or whitelisting solutions to restrict the Kiro IDE from executing shell commands or other unauthorized processes.
• Enforce strict network egress filtering on developer workstations to block unauthorized outbound connections.
• Educate developers on the risks of cloning and opening projects from untrusted or unverified sources.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 10, 2026, there are no known public proof-of-concept exploits or reports of this vulnerability being actively exploited in the wild. The attack vector requires user interaction, such as tricking a developer into opening a malicious project, which makes it a prime candidate for targeted phishing or social engineering campaigns.

Analyst Recommendation
Given the high-severity CVSS score of 7.8 and the potential for complete system compromise, it is strongly recommended that organizations prioritize the immediate deployment of the vendor-supplied patches to all affected Kiro IDE installations. While this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, its potential for enabling data theft and lateral movement warrants urgent attention. If patching is delayed, implement the suggested compensating controls and proactive monitoring to reduce the risk of exploitation.

Executive Summary:
A high-severity vulnerability has been identified in the GitLab Language Server, designated CVE-2025-8279. This flaw results from insufficient input validation and could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying system. Successful exploitation could lead to a complete compromise of the affected system, enabling theft of source code, injection of malicious code, or lateral movement within the network.

Vulnerability Details

CVE-ID: CVE-2025-8279

Affected Software: GitLab Language Server

Affected Versions: GitLab Language Server version 7.x. See vendor advisory for specific affected versions.

Vulnerability: The GitLab Language Server fails to properly sanitize user-supplied input. An attacker can exploit this by sending a specially crafted request or opening a malicious project file in an integrated development environment (IDE) that utilizes the language server. This malformed input is processed by the server, leading to a condition that allows for arbitrary code execution with the permissions of the user running the language server process.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.7. Exploitation could have a significant business impact, particularly as the language server often runs on developer workstations or within CI/CD pipelines, which are critical and trusted environments. A successful attack could lead to the compromise of intellectual property (source code), theft of developer credentials, injection of backdoors into the software supply chain, or a complete denial of service for development teams. This poses a direct risk to data confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor immediately across all affected systems. After patching, it is crucial to monitor systems for any signs of post-patch exploitation attempts and review historical access logs for indicators of compromise that may have occurred before the patch was applied.

Proactive Monitoring: Security teams should implement enhanced monitoring focused on the GitLab Language Server process. Look for unusual child processes, unexpected network connections originating from the server, or modifications to files outside of the expected project scope. Review application and system logs for error messages or malformed requests that could indicate scanning or exploitation attempts.

Compensating Controls: If immediate patching is not feasible, organizations should implement compensating controls. These include running the GitLab Language Server in a sandboxed or containerized environment to limit the blast radius of a potential compromise. Additionally, apply strict egress filtering to prevent the process from connecting to unauthorized external hosts and use application whitelisting to block the execution of unexpected commands or binaries.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 28, 2025, there are no known public exploits or active campaigns targeting this vulnerability. However, due to the high CVSS score and the widespread use of GitLab, it is highly probable that proof-of-concept exploits will be developed by security researchers and threat actors. This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the high severity (CVSS 8.7) and the risk of remote code execution within critical development environments, this vulnerability requires immediate attention. We strongly recommend that organizations prioritize the deployment of the vendor-supplied patches to all developer workstations and CI/CD systems running the affected GitLab Language Server. While there is no current evidence of active exploitation, the potential for supply chain attacks makes proactive remediation essential. Continue to monitor for changes in threat intelligence and for this CVE's potential addition to the CISA KEV catalog.

Executive Summary:
A high-severity Denial of Service (DoS) vulnerability has been identified in GitLab Community and Enterprise Editions. An attacker can exploit this flaw by sending a specially crafted query to the GraphQL endpoint, causing the application to become unresponsive and unavailable to all users. This can lead to significant disruption of software development and deployment operations.

Vulnerability Details

CVE-ID: CVE-2025-8014

Affected Software: versions Multiple Products

Affected Versions: All versions of GitLab Community Edition (CE) and Enterprise Edition (EE) from 11.0 onwards.

Vulnerability: The vulnerability exists within the GraphQL API endpoint of GitLab. An unauthenticated attacker can send a specially crafted, complex GraphQL query designed to consume excessive server resources, such as CPU and memory. The server's attempt to process this resource-intensive query leads to performance degradation and ultimately a denial of service, preventing legitimate users from accessing the GitLab instance.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Exploitation would result in the unavailability of the GitLab service, directly impacting business operations. The primary consequence is the disruption of the entire software development lifecycle, including code commits, CI/CD pipeline execution, and project management. This can lead to significant productivity losses, missed deadlines, and a temporary halt in software delivery, posing a direct risk to business continuity.

Remediation Plan

Immediate Action: Apply the security updates provided by the vendor immediately to patch the vulnerability. After patching, continue to monitor GraphQL endpoints for any signs of exploitation attempts and review web server and application access logs for anomalous activity.

Proactive Monitoring: Security teams should monitor for indicators of compromise, including an unusual volume of requests to the /api/graphql endpoint, sustained high CPU or memory utilization on GitLab servers, and application-level alerts indicating service unresponsiveness. Review logs for unusually large or deeply nested GraphQL queries originating from a single or small set of IP addresses.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) rule to block or rate-limit overly complex GraphQL queries. Consider temporarily restricting network access to the GraphQL endpoint to only trusted internal sources until patches can be applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 28, 2025, there is no known public proof-of-concept exploit code, and no active exploitation has been observed in the wild. However, given the simplicity of exploiting such DoS vulnerabilities, it is highly probable that exploit code will be developed and released by security researchers in the near future.

Analyst Recommendation
Given the high severity of this vulnerability (CVSS 7.5) and its direct impact on critical development infrastructure, organizations are strongly advised to prioritize the deployment of vendor-supplied security patches. Although this CVE is not currently listed on the CISA KEV catalog, the potential for significant operational disruption warrants immediate attention. All vulnerable GitLab instances should be identified and remediated without delay to prevent service outages.

Executive Summary:
A high-severity vulnerability has been identified in GitLab Community and Enterprise Editions, which could allow a remote, unauthenticated attacker to compromise the platform. Successful exploitation could lead to unauthorized access to sensitive source code, disruption of software development pipelines, and potential takeover of the underlying server. Organizations are urged to apply security patches immediately to mitigate the significant risk to intellectual property and operational integrity.

Vulnerability Details

CVE-ID: CVE-2025-6948

Affected Software: GitLab Community Edition (CE) and Enterprise Edition (EE)

Affected Versions: All versions starting from 17.0.0. See vendor advisory for specific patched versions.

Vulnerability: This vulnerability is a critical path traversal flaw within the web interface component responsible for handling repository imports. An unauthenticated remote attacker can craft a malicious web request containing specially formatted path traversal sequences (../). Due to improper input sanitization, the application processes this input, allowing the attacker to read arbitrary files from the GitLab server's filesystem with the permissions of the GitLab service account. This could expose sensitive configuration files, credentials, and private SSH keys stored on the server.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.7, posing a significant risk to the organization. Exploitation could lead to a severe breach of confidentiality and integrity. Key business impacts include the theft of proprietary source code and intellectual property, exposure of developer credentials and API keys stored in repositories, and disruption of critical CI/CD pipelines, halting development and deployment operations. A successful attack could result in significant financial loss, reputational damage, and a complete compromise of the organization's software development infrastructure.

Remediation Plan

Immediate Action: Apply the security updates provided by GitLab immediately across all affected instances. Prioritize patching for internet-facing GitLab servers. After patching, continue to monitor for any signs of exploitation attempts by reviewing access logs for anomalous activity that may have occurred prior to the update.

Proactive Monitoring: Security teams should actively monitor web server and application logs for suspicious patterns. Look for unusual requests to repository import endpoints, especially those containing URL-encoded path traversal sequences (e.g., %2e%2e%2f). Monitor for unexpected outbound network connections from the GitLab server and any unusual processes spawned by the git user, which could indicate a successful compromise.

Compensating Controls: If immediate patching is not feasible, implement compensating controls as a temporary measure. Restrict network access to the GitLab instance to only trusted IP addresses using a perimeter firewall. Deploy a Web Application Firewall (WAF) with rules designed to detect and block path traversal attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2025, there are no known public exploits or reports of this vulnerability being actively exploited in the wild. However, given the critical nature of the flaw and the widespread deployment of GitLab, it is highly probable that security researchers and threat actors will develop a functional exploit in the near future.

Analyst Recommendation

This vulnerability represents a critical threat to organizations utilizing GitLab. Given the high CVSS score of 8.7 and the potential for complete system compromise, immediate action is required. Although this CVE is not currently listed on the CISA KEV list, its severity dictates that it should be treated with the highest priority. We strongly recommend that all organizations apply the vendor-supplied patches immediately. For internet-facing instances, patching should be considered an emergency change and implemented without delay.

Executive Summary:
A high-severity vulnerability has been discovered in GitLab Community and Enterprise Editions that could allow an authenticated attacker to gain unauthorized elevated privileges. Successful exploitation could lead to the compromise of sensitive source code repositories, manipulation of software build processes, and unauthorized access to critical development infrastructure.

Vulnerability Details

CVE-ID: CVE-2025-12571

Affected Software: GitLab Community Edition (CE) and Enterprise Edition (EE)

Affected Versions: All versions from 17.0.0 before the patched releases. See vendor advisory for specific patched versions.

Vulnerability: This is an improper access control vulnerability within GitLab's project management functionality. An authenticated attacker with low-level permissions can exploit this flaw by crafting a specialized request to the API. This request bypasses standard authorization checks, allowing the attacker to escalate their privileges within a target project to a 'Maintainer' or 'Owner' role, granting them administrative control over the repository, its settings, and its CI/CD pipeline.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Successful exploitation could grant an attacker elevated privileges, leading to significant business consequences. These include the potential for intellectual property theft through unauthorized access to private source code repositories, the ability to inject malicious code into the software supply chain via CI/CD pipelines, and the disruption of critical development and deployment operations. Unauthorized administrative access could also lead to reputational damage and a loss of customer trust.

Remediation Plan

Immediate Action: Immediately apply the security updates released by GitLab to all affected instances. After patching, it is crucial to monitor for any signs of exploitation that may have occurred prior to the update and thoroughly review system access logs for suspicious or unauthorized activity.

Proactive Monitoring: Security teams should monitor GitLab application and audit logs for an unusual number of user role changes, especially those not associated with a legitimate administrative action or ticket. Monitor for unexpected modifications to project settings or CI/CD configuration files (.gitlab-ci.yml). Alert on API access from low-privileged users to administrative endpoints.

Compensating Controls: If immediate patching is not feasible, implement stricter access controls and review all user permissions, enforcing the principle of least privilege. Consider implementing a web application firewall (WAF) with rules designed to block the specific malicious request patterns. Increase the monitoring and alerting threshold for all administrative actions and user role modifications within the platform.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 27, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, given the high-severity rating and the critical role of GitLab in development pipelines, security researchers and threat actors are likely to analyze the patch and develop exploits in the near future.

Analyst Recommendation

Due to the high severity (CVSS 7.5) of this vulnerability and its potential impact on critical development infrastructure and intellectual property, we strongly recommend that all affected GitLab instances be patched immediately. Although this vulnerability is not currently listed on the CISA KEV catalog and there is no known public exploit, the risk of exploitation is significant. Organizations should prioritize the deployment of vendor-supplied updates and implement the recommended monitoring controls to secure their software supply chain against potential compromise.