gitlab

Disclosed vulnerabilities where the NVD names gitlab as an affected vendor, highest CVSS first.

1. CRITICAL 10CVE-2026-1102642026-10-22

   An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have…

   gitlab

   AI risk analysis on Exploit-DB.ai →

2. CRITICAL 10CVE-2026-972292026-10-13

   GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server …

   gitlab

   AI risk analysis on Exploit-DB.ai →

3. CRITICAL 9.9CVE-2026-935772026-09-24

   GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due …

   gitlab

   AI risk analysis on Exploit-DB.ai →

4. CRITICAL 9.9CVE-2026-890782026-09-24

   GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due …

   gitlab

   AI risk analysis on Exploit-DB.ai →

5. HIGH 8.7CVE-2026-928832026-10-13

   GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context o…

   gitlab

   AI risk analysis on Exploit-DB.ai →

6. HIGH 8.7CVE-2026-847392026-09-29

   GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of …

   gitlab

   AI risk analysis on Exploit-DB.ai →

7. HIGH 8.5CVE-2026-163012026-10-13

   GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on…

   gitlab

   AI risk analysis on Exploit-DB.ai →

8. HIGH 8.2CVE-2026-157232026-10-22

   GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing …

   gitlab

   AI risk analysis on Exploit-DB.ai →

9. HIGH 8.2CVE-2026-148142026-10-13

   GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted user…

   gitlab

   AI risk analysis on Exploit-DB.ai →

10. HIGH 7.7CVE-2026-818392026-10-13

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferre…

    gitlab

    AI risk analysis on Exploit-DB.ai →

11. HIGH 7.7CVE-2026-924702026-09-24

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-m…

    gitlab

    AI risk analysis on Exploit-DB.ai →

12. HIGH 7.5CVE-2026-1122122026-10-22

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document…

    gitlab

    AI risk analysis on Exploit-DB.ai →

13. HIGH 7.3CVE-2026-968932026-10-13

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent in…

    gitlab

    AI risk analysis on Exploit-DB.ai →

14. MEDIUM 6.8CVE-2026-126642026-10-22

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with a read_api-scoped token to retrieve a projec…

    gitlab

    AI risk analysis on Exploit-DB.ai →

15. MEDIUM 6.2CVE-2026-1011682026-10-13

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with access to GitLab Pages log data to obtain ac…

    gitlab

    AI risk analysis on Exploit-DB.ai →

16. MEDIUM 5.8CVE-2026-77672026-10-13

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitiv…

    gitlab

    AI risk analysis on Exploit-DB.ai →

17. MEDIUM 5.4CVE-2026-928742026-09-24

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with an MCP-scoped token to perform actions beyond …

    gitlab

    AI risk analysis on Exploit-DB.ai →

18. MEDIUM 5.3CVE-2026-855292026-10-13

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidential system …

    gitlab

    AI risk analysis on Exploit-DB.ai →

19. MEDIUM 5.3CVE-2026-842842026-10-13

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, all 19.3 versions, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups …

    gitlab

    AI risk analysis on Exploit-DB.ai →

20. MEDIUM 5.3CVE-2026-162752026-10-13

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read confidential notes on public projects d…

    gitlab

    AI risk analysis on Exploit-DB.ai →

21. MEDIUM 4.6CVE-2026-1007552026-10-13

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain deployment configurations, could have allowed an authenticated user to poison cached page content serv…

    gitlab

    AI risk analysis on Exploit-DB.ai →

22. MEDIUM 4.3CVE-2026-133192026-10-22

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project pa…

    gitlab

    AI risk analysis on Exploit-DB.ai →

23. MEDIUM 4.3CVE-2026-1057772026-10-22

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due t…

    gitlab

    AI risk analysis on Exploit-DB.ai →

24. MEDIUM 4.3CVE-2026-65672026-10-13

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.8 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with reporter role to access restricted CI artifa…

    gitlab

    AI risk analysis on Exploit-DB.ai →

25. MEDIUM 4.3CVE-2026-145522026-10-13

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Guest access to read confidential epic conte…

    gitlab

    AI risk analysis on Exploit-DB.ai →

26. MEDIUM 4.3CVE-2026-142102026-10-13

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a project-scoped fine-grained Personal Acce…

    gitlab

    AI risk analysis on Exploit-DB.ai →

27. MEDIUM 4.3CVE-2026-1054582026-10-13

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a specific granular permission to obtain a G…

    gitlab

    AI risk analysis on Exploit-DB.ai →

28. MEDIUM 4.3CVE-2026-1046612026-10-13

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a custom role with compliance framework admi…

    gitlab

    AI risk analysis on Exploit-DB.ai →

29. MEDIUM 4.3CVE-2026-89372026-09-29

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to read private child issue contents, including tit…

    gitlab

    AI risk analysis on Exploit-DB.ai →

30. MEDIUM 4.3CVE-2026-105182026-09-29

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security …

    gitlab

    AI risk analysis on Exploit-DB.ai →

31. MEDIUM 4.3CVE-2026-925302026-09-24

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute con…

    gitlab

    AI risk analysis on Exploit-DB.ai →

32. MEDIUM 4.3CVE-2026-925292026-09-24

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass admin-config…

    gitlab

    AI risk analysis on Exploit-DB.ai →

33. MEDIUM 4.2CVE-2026-925282026-10-13

    GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to approve a merge request despite having contribut…

    gitlab

    AI risk analysis on Exploit-DB.ai →

34. MEDIUM 4.2CVE-2026-783352026-10-13

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a project-scoped fine-grained Personal Ac…

    gitlab

    AI risk analysis on Exploit-DB.ai →

35. MEDIUM 4.2CVE-2026-59542026-10-13

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to download package files from a public project due to improper …

    gitlab

    AI risk analysis on Exploit-DB.ai →

36. LOW 3.7CVE-2026-45232026-09-29

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sens…

    gitlab

    AI risk analysis on Exploit-DB.ai →

37. LOW 3.5CVE-2026-1057112026-10-22

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated us…

    gitlab

    AI risk analysis on Exploit-DB.ai →

38. LOW 3.5CVE-2026-1001042026-10-13

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach …

    gitlab

    AI risk analysis on Exploit-DB.ai →

39. LOW 3.1CVE-2026-1123262026-10-22

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with read-only permissions to permanently delete exi…

    gitlab

    AI risk analysis on Exploit-DB.ai →

40. LOW 3.1CVE-2026-826322026-10-13

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a fine-grained Personal Access Token scoped …

    gitlab

    AI risk analysis on Exploit-DB.ai →

41. LOW 3.1CVE-2026-926282026-09-24

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned u…

    gitlab

    AI risk analysis on Exploit-DB.ai →

42. LOW 2.7CVE-2026-92682026-10-13

    GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project CI/CD dep…

    gitlab

    AI risk analysis on Exploit-DB.ai →

43. LOW 2.7CVE-2026-1035492026-10-13

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with maintainer-role permissions to remove certai…

    gitlab

    AI risk analysis on Exploit-DB.ai →