Search: “GitLab.com”

12 stories

GitLab patched a critical unauthenticated code injection flaw CVE-2026-19478 (CVSS 9.4) enabling modification or deletion of public projects; upgrades urged.

GitLab released patches for two vulnerabilities affecting Community Edition (CE) and Enterprise Edition (EE) versions 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. CVE-2026-19478 (CVSS 9.4) is an unauthenticated code injection via a GraphQL directive, exploitable remotely without user interaction, allowing attackers to modify or delete public projects and user data. CVE-2026-19650 (CVSS 7.1) is a cross-site request forgery issue in the GraphQL multiplex query handler allowing mutations via GET requests with user interaction. Fixes are available in 18.11.11, 19.0.8, 19.1.6, and 19.2.4; both flaws were reported via GitLab's HackerOne bug bounty program.

Help Net SecurityAug 18, 00:00 UTC · 29d agoVulnerability CVE-2026-19478 CVE-2026-196501

Critical GitLab flaw allows account takeover without user interaction, patch quickly! (CVE-2023-7028)

Help Net SecurityMay 2, 08:55 UTC · May 2, 2024Vulnerability in the wildCVE-2023-7028 CVE-2023-5356 CVE-2023-4812+2 CVEs

Self-managed GitLab installations should be patched again (CVE-2024-0402)

Help Net SecurityJan 30, 00:00 UTC · Jan 30, 2024Vulnerability CVE-2024-0402 CVE-2023-5933 CVE-2023-5612+2 CVEs1

GitLab plugs critical flaw in its code repository manager software

Help Net SecurityNov 22, 09:21 UTC · Nov 22, 2023Vulnerability CVE-2016-9086

CVE-2026-85706 | GitLab CE/EE Repository Commits API Path Traversal Vulnerability

GitLab patches CVSS 10.0 path traversal CVE-2026-85706 letting unauthenticated attackers read arbitrary files on self-managed CE/EE servers.

GitLab disclosed CVE-2026-85706, a CVSS 3.1 10.0 path traversal flaw in the repository commits API of self-managed GitLab CE/EE (18.7 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2), exploitable without authentication to read arbitrary server files. Successful exploitation can expose credentials, tokens, SSH keys, and database credentials accessible to the GitLab process. Fixed versions 19.1.8, 19.2.6, and 19.3.2 were released September 10, 2026; GitLab.com and Dedicated were already patched and no workaround is provided. Horizon3 released a NodeZero Rapid Response test to validate exposure and advises credential rotation for internet-facing instances.

Horizon3.aiupdated Sep 15, 00:52 UTC · 1d agofirst Sep 11, 20:13 UTC · 5d agoVulnerability 18 sources CVE-2026-857061

Critical GitLab Flaws Let Attackers Read Arbitrary Files, Steal Credentials and Execute Code

GitLab issues emergency patches for critical path-traversal flaw CVE-2026-85706 (CVSS 10.0), GraphQL credential exposure CVE-2026-87719, and potential RCE flaw CVE-2026-88765.

GitLab released versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026, fixing 18 vulnerabilities across Community and Enterprise Editions. CVE-2026-85706 allows unauthenticated arbitrary file reads via the repository commits API; CVE-2026-87719 exposes Advanced Search credentials through GraphQL subscription deserialization; CVE-2026-88765 may enable authenticated RCE via crafted project export imports. No exploitation was reported, but self-managed administrators are urged to upgrade immediately and review logs for suspicious API and GraphQL activity.

GBHackersSep 11, 10:13 UTC · 5d agoVulnerability CVE-2026-85706 CVE-2026-87719 CVE-2026-88765+15 CVEs1

URGENT: Upgrade GitLab - Critical Workspace Creation Flaw Allows File Overwrite

The Hacker NewsJan 30, 16:18 UTC · Jan 30, 2024Vulnerability CVE-2024-0402 CVE-2023-7028

GitLab fixes critical vulnerability, patch now! (CVE-2023-5009)

Help Net SecuritySep 22, 00:00 UTC · Sep 22, 2023Vulnerability CVE-2023-5009 CVE-2023-3932 CVE-2022-41903+1 CVEs1

Critical RCE bug in GitLab patched, update ASAP! (CVE-2022-2884)

Help Net SecurityAug 24, 00:00 UTC · Aug 24, 2022Vulnerability in the wildCVE-2022-28841