Search: “GitLab.com”

17 stories

GitLab patched a critical unauthenticated code injection flaw CVE-2026-19478 (CVSS 9.4) enabling modification or deletion of public projects; upgrades urged.

GitLab released patches for two vulnerabilities affecting Community Edition (CE) and Enterprise Edition (EE) versions 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. CVE-2026-19478 (CVSS 9.4) is an unauthenticated code injection via a GraphQL directive, exploitable remotely without user interaction, allowing attackers to modify or delete public projects and user data. CVE-2026-19650 (CVSS 7.1) is a cross-site request forgery issue in the GraphQL multiplex query handler allowing mutations via GET requests with user interaction. Fixes are available in 18.11.11, 19.0.8, 19.1.6, and 19.2.4; both flaws were reported via GitLab's HackerOne bug bounty program.

Help Net SecurityAug 18, 00:00 UTC · 29d agoVulnerability CVE-2026-19478 CVE-2026-196501

Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects

GitLab urgently patched CVE-2026-19478 (CVSS 9.4), a critical unauthenticated GraphQL flaw allowing modification or deletion of public projects on self-managed instances.

GitLab released an out-of-band critical patch on August 17, 2026 fixing CVE-2026-19478 (CVSS 9.4), a flaw that under certain conditions lets unauthenticated attackers remotely modify or delete public projects and user data via a GraphQL directive in Community and Enterprise Editions. Fixes are available in GitLab 19.2.4, 19.1.6, 19.0.8, and 18.11.11; GitLab.com and GitLab Dedicated are already patched, so only self-managed installations need to act. The release also fixes CVE-2026-19650 (CVSS 7.1), a cross-site request forgery flaw in GraphQL multiplex query handling requiring user interaction. No exploitation or public exploit code has been observed as of August 18, 2026.

The Hacker NewsAug 17, 21:03 UTC · 29d agoVulnerability CVE-2026-19478 CVE-2026-196501

Rust package registry adds security tools and metrics to crates.io

Help Net SecurityJan 21, 00:00 UTC · Jan 21, 2026Vulnerability

Critical GitLab flaw allows account takeover without user interaction, patch quickly! (CVE-2023-7028)

Help Net SecurityMay 2, 08:55 UTC · May 2, 2024Vulnerability in the wildCVE-2023-7028 CVE-2023-5356 CVE-2023-4812+2 CVEs

Why CISA is Warning CISOs About a Breach at Sisense

Krebs on SecurityApr 11, 21:08 UTC · Apr 11, 2024Vulnerability

Self-managed GitLab installations should be patched again (CVE-2024-0402)

Help Net SecurityJan 30, 00:00 UTC · Jan 30, 2024Vulnerability CVE-2024-0402 CVE-2023-5933 CVE-2023-5612+2 CVEs1

GitLab plugs critical flaw in its code repository manager software

Help Net SecurityNov 22, 09:21 UTC · Nov 22, 2023Vulnerability CVE-2016-9086

CVE-2026-85706 | GitLab CE/EE Repository Commits API Path Traversal Vulnerability

GitLab patches CVSS 10.0 path traversal CVE-2026-85706 letting unauthenticated attackers read arbitrary files on self-managed CE/EE servers.

GitLab disclosed CVE-2026-85706, a CVSS 3.1 10.0 path traversal flaw in the repository commits API of self-managed GitLab CE/EE (18.7 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2), exploitable without authentication to read arbitrary server files. Successful exploitation can expose credentials, tokens, SSH keys, and database credentials accessible to the GitLab process. Fixed versions 19.1.8, 19.2.6, and 19.3.2 were released September 10, 2026; GitLab.com and Dedicated were already patched and no workaround is provided. Horizon3 released a NodeZero Rapid Response test to validate exposure and advises credential rotation for internet-facing instances.

Horizon3.aiupdated Sep 15, 00:52 UTC · 1d agofirst Sep 11, 20:13 UTC · 4d agoVulnerability 17 sources CVE-2026-857061

Critical GitLab Flaws Let Attackers Read Arbitrary Files, Steal Credentials and Execute Code

GitLab issues emergency patches for critical path-traversal flaw CVE-2026-85706 (CVSS 10.0), GraphQL credential exposure CVE-2026-87719, and potential RCE flaw CVE-2026-88765.

GitLab released versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026, fixing 18 vulnerabilities across Community and Enterprise Editions. CVE-2026-85706 allows unauthenticated arbitrary file reads via the repository commits API; CVE-2026-87719 exposes Advanced Search credentials through GraphQL subscription deserialization; CVE-2026-88765 may enable authenticated RCE via crafted project export imports. No exploitation was reported, but self-managed administrators are urged to upgrade immediately and review logs for suspicious API and GraphQL activity.

GBHackersSep 11, 10:13 UTC · 5d agoVulnerability CVE-2026-85706 CVE-2026-87719 CVE-2026-88765+15 CVEs1

GitLab Duo Agent Platform solves the AI paradox in software delivery

Help Net SecurityJan 16, 00:00 UTC · Jan 16, 2026Vulnerability1

URGENT: Upgrade GitLab - Critical Workspace Creation Flaw Allows File Overwrite

The Hacker NewsJan 30, 16:18 UTC · Jan 30, 2024Vulnerability CVE-2024-0402 CVE-2023-7028

GitLab fixes critical vulnerability, patch now! (CVE-2023-5009)

Help Net SecuritySep 22, 00:00 UTC · Sep 22, 2023Vulnerability CVE-2023-5009 CVE-2023-3932 CVE-2022-41903+1 CVEs1

Crypto-mining gangs are running amok on free cloud computing platforms

The RecordDec 21, 00:00 UTC · Dec 21, 2022Vulnerability

Critical RCE bug in GitLab patched, update ASAP! (CVE-2022-2884)

Help Net SecurityAug 24, 00:00 UTC · Aug 24, 2022Vulnerability in the wildCVE-2022-28841