Loading story…
Reporting highlighted a GitLab authentication weakness in which a 2FA login protection bypass could allow attackers to take over accounts, enabling unauthorized access to GitLab instances and the ability to act as legitimate users. With access, an attacker could perform source-code actions such as downloading, altering, or deleting repositories, creating direct risks to software integrity and the SDLC.
Commentary from SANS Institute’s Johannes Ullrich noted that, in practice, attackers may find phishing and other social engineering more efficient for obtaining valid credentials than attempting to forge device credentials to exploit the bypass, but the end-state risk remains the same once passwords are obtained. Recommended defensive measures emphasized layered identity controls: enforce long/unique passwords, monitor for anomalous access patterns (e.g., logins without a corresponding MFA challenge), and ensure an incident response plan is ready if account compromise is suspected.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A news item noted that Ingram Micro stated 42,000 people were impacted by a ransomware attack. No separate event date is given in the reference summary, so the publication date is used.
CSO Online and InfoWorld reported a GitLab two-factor authentication login protection bypass that could let attackers take over user accounts. The references do not provide a more specific disclosure date, so the event is dated from the articles' publication date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released security updates for self-managed **GitLab Community Edition (CE)** and **Enterprise Edition (EE)** to fix a high-severity **two-factor authentication (2FA) bypass** and multiple **denial-of-service (DoS)** flaws. The most significant issue, **CVE-2026-0723** (CVSS 7.4), is an *unchecked return value* weakness in authentication services that could allow an attacker with knowledge of a victim’s credential/account ID to bypass 2FA by submitting forged device responses. GitLab also patched DoS vulnerabilities affecting unauthenticated and authenticated scenarios, including crafted malformed authentication data against the **Jira Connect** integration (**CVE-2025-13927**), incorrect authorization validation in API endpoints such as the **Releases API** (**CVE-2025-13928**), malformed Wiki documents that bypass cycle detection (**CVE-2025-13335**), and repeated malformed SSH authentication requests (**CVE-2026-1102**). Fixed releases are **18.8.2**, **18.7.2**, and **18.6.4**; GitLab advised administrators to upgrade immediately, noting *GitLab.com* is already patched, while third-party tracking indicated thousands of exposed GitLab CE instances remain online and potentially at risk if unpatched.
Jun 29, 2026
GitLab released emergency security updates across multiple CE and EE versions to fix **CVE-2024-45409**, a critical SAML authentication bypass affecting self-managed instances configured for SAML-based sign-in. The company said the issue was mitigated by updating `omniauth-saml` to `2.2.1` and `ruby-saml` to `1.17.0`, and urged administrators to upgrade immediately to patched releases spanning the 17.x and 16.x branches. GitLab.com and GitLab Dedicated were already remediated and were not exposed in the same way. GitLab also published mitigation and threat-hunting guidance for organizations that could not patch immediately, including enforcing GitLab two-factor authentication for all users and disabling the SAML two-factor bypass option. To help defenders identify attempted or successful exploitation, the advisories pointed to review of `application_json` and `auth_json` logs and shared Sigma-style detection ideas focused on anomalous `extern_uid` values and suspicious IP mismatches during authentication events.
Jul 24, 2026
GitLab released security updates for Community Edition and Enterprise Edition to fix multiple vulnerabilities, led by **CVE-2023-7028**, a critical password reset flaw that could send reset emails to an unverified address and enable account takeover. The issue was assigned a **CVSS 10.0** score, and GitLab said **GitLab.com** had already been patched while it had not detected abuse of the flaw on GitLab-managed platforms. The same release also addressed **CVE-2023-5356**, which involved abuse of Slack and Mattermost slash commands, along with **CVE-2023-4812**, **CVE-2023-6955**, and **CVE-2023-2030**. GitLab initially shipped fixes in versions **16.7.2**, **16.6.4**, and **16.5.6**, then advised customers to move to **16.7.3**, **16.6.5**, **16.5.7**, or newer because of an additional database migration issue in the earlier patch set. The company urged self-managed administrators to upgrade promptly, enable **2FA**, and review logs for signs of exploitation attempts, reflecting the severity of the account takeover risk and the broader exposure from the other patched flaws.
Aug 31, 2026