Loading story…
GitLab has addressed two high-severity vulnerabilities in its GraphQL API, impacting both Community Edition (CE) and Enterprise Edition (EE) deployments. One of the vulnerabilities, tracked as CVE-2025-10004, allows unauthenticated attackers to launch denial-of-service (DoS) attacks by sending specially crafted GraphQL queries that request large repository blobs. This exploit can exhaust server resources, leading to severe performance degradation or complete unavailability of GitLab services. The vulnerability affects GitLab versions prior to 18.4.2, 18.3.4, and 18.2.8, and administrators are urged to upgrade to these patched versions immediately. The flaw is particularly critical for public-facing GitLab instances, as it does not require authentication to exploit, increasing the risk of opportunistic attacks. The CVE-2025-10004 vulnerability received a CVSS v3.1 base score of 7.5, underscoring its high risk to organizations relying on GitLab for source control and CI/CD pipelines. In addition to CVE-2025-10004, GitLab also patched other high-severity issues in the same update cycle, including vulnerabilities related to GraphQL authorization and JSON file uploads, both of which could also result in DoS conditions. GitLab.com and GitLab Dedicated customers were not affected by these vulnerabilities, as those platforms were either already patched or architecturally isolated from the exposure. The company responded promptly by releasing security updates and providing guidance for self-managed instance administrators. The vulnerabilities could have enabled attackers to disrupt development workflows, potentially creating further security risks during periods of downtime. Security professionals are advised to prioritize patching and to review their exposure, especially for internet-accessible GitLab deployments. The incident highlights the importance of timely vulnerability management in DevOps environments, where service availability is critical. GitLab's swift response and transparent disclosure have been commended by the security community. Organizations are also encouraged to monitor for unusual activity and to implement additional controls to limit the impact of potential DoS attacks. The vulnerabilities were discovered and reported through responsible disclosure channels, enabling GitLab to coordinate a secure and effective patch release. This event serves as a reminder for all DevOps teams to maintain up-to-date software and to stay informed about security advisories affecting their toolchains. The technical details of the vulnerabilities emphasize the need for robust input validation and resource management in API design. GitLab's handling of the incident demonstrates best practices in vulnerability response and communication.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
GitLab patched two high-severity vulnerabilities affecting the GraphQL API in both Community Edition and Enterprise Edition. One of the disclosed issues is CVE-2025-10004, a denial-of-service vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released out-of-band security updates for self-managed Community Edition and Enterprise Edition instances to fix **CVE-2026-19478**, a critical GraphQL directive flaw that can let an unauthenticated remote attacker modify or delete public projects and user data under certain conditions. The vulnerability, classified as **CWE-94** and rated **CVSS 9.4**, affects versions from `18.2` before `18.11.11`, `19.0` before `19.0.8`, `19.1` before `19.1.6`, and `19.2` before `19.2.4`. GitLab also fixed **CVE-2026-19650**, a high-severity cross-site request forgery issue in the GraphQL multiplex query handler that could allow unauthenticated mutation execution via `GET` requests with user interaction. Patched releases are **19.2.4**, **19.1.6**, **19.0.8**, and **18.11.11**; **GitLab.com** and **GitLab Dedicated** were already remediated and require no customer action. GitLab urged affected self-managed customers to upgrade immediately, and reporting indicated no disclosed in-the-wild exploitation or public exploit code at the time of release.
Sep 2, 2026
GitLab released security updates for Community Edition and Enterprise Edition in versions **18.10.3**, **18.9.5**, and **18.8.9**, patching multiple vulnerabilities that affect self-managed deployments and urging administrators to upgrade immediately. The fixes address high-severity issues including a websocket access control flaw, denial-of-service conditions, and unintended server-side command execution tied to vulnerabilities such as `CVE-2026-5173`, `CVE-2026-1092`, and `CVE-2025-12664`. The release also resolves medium- and low-severity weaknesses involving code injection, cross-site scripting, GraphQL-related denial of service, CSV import and export handling, authorization bypasses, and information disclosure affecting private projects, protected environments, and custom roles. GitLab said some affected code paths date back to versions as old as 11.3 and 12.10, while **GitLab.com** and **GitLab Dedicated** are already protected; the company added that the patches require no new migrations and can be applied to multi-node deployments without downtime, although Omnibus packages still restart services during updates.
Jun 29, 2026
GitLab released security updates for Community Edition and Enterprise Edition, shipping versions **18.10.3**, **18.9.5**, and **18.8.9** to address multiple vulnerabilities tracked as `CVE-2026-5173`, `CVE-2026-1092`, `CVE-2025-12664`, and `CVE-2026-1101`. The patched issues include a high-severity flaw that could allow unintended server-side method invocation over WebSocket connections, along with several denial-of-service weaknesses affecting the Terraform state lock API and the GraphQL API. The release also fixes medium- and low-severity bugs including cross-site scripting in analytics dashboards, code-injection-related IP leakage in Code Quality reports, authorization weaknesses in APIs and custom roles, and information disclosure through GraphQL queries and CSV export. GitLab said **GitLab.com** had already been patched, **GitLab Dedicated** customers did not need to take action, and self-managed customers should upgrade immediately; the company added that the updates require no new migrations and should not cause downtime in multi-node deployments.
Jul 24, 2026