CVE-2026-3855

GitLab CVE-2026-3855 is a resource identifier validation flaw (CWE-99) in the Terraform state upload functionality of GitLab CE and EE. An authenticated user holding project-level permissions can trigger it by supplying manipulated parameters during a Terraform state upload, and under certain conditions this allows them to read file contents on the server that should be restricted, or to cause a denial-of-service condition on the instance. The flaw carries a low CVSS 3.1 score of 3.1 because exploitation requires valid project-level credentials and high attack conditions, and the broader 'critical GitLab flaws' coverage refers to a set of fixes rather than this issue specifically. All self-managed GitLab CE/EE deployments running versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, or 19.3 before 19.3.2 are affected. No public proof-of-concept or confirmed in-the-wild exploitation is currently known, and the issue is not listed in CISA's KEV catalog.

What to do: Upgrade self-managed GitLab CE/EE to 19.3.2, 19.2.6, or 19.1.8 (or later) depending on your version track. Because exploitation requires a project-level account, review project memberships for over-privileged users and inspect audit/API logs for anomalous Terraform state upload requests or unexplained instance crashes. GitLab.com and GitLab Dedicated environments are remediated by GitLab and require no customer action.