Loading story…
GitLab disclosed and remediated two high-severity vulnerabilities in GitLab CE/EE that could expose sensitive data and enable unauthorized actions. CVE-2026-3857 is a CWE-352 cross-site request forgery flaw in GitLab GraphQL functionality caused by insufficient CSRF protection, allowing an unauthenticated attacker to trigger arbitrary GraphQL mutations on behalf of an authenticated user if that user can be induced to interact. The issue affects versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1.
GitLab also fixed CVE-2026-5173, a CWE-749 improper access control issue that lets an authenticated user invoke unintended server-side methods over websocket connections. That flaw affects versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3, with GitLab rating it as network-exploitable with low attack complexity and significant confidentiality impact. GitLab published patch release information and related work items for both vulnerabilities, urging customers to update affected self-managed deployments to the fixed releases.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
On April 8, 2026, GitLab disclosed CVE-2026-5173, an improper access control issue in GitLab CE/EE that could allow an authenticated user to invoke unintended server-side methods through websocket connections. GitLab reported the flaw affected versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3, and released patch information alongside an associated work item.
On March 25, 2026, GitLab disclosed CVE-2026-3857, a CSRF vulnerability in GitLab CE/EE GraphQL functionality that could let an unauthenticated attacker trigger arbitrary GraphQL mutations on behalf of authenticated users. GitLab said the issue affected versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1, and published remediation references including a patch release announcement, work item, and HackerOne report.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab disclosed and remediated three high-severity vulnerabilities in GitLab CE/EE that could be exploited by unauthenticated attackers under certain conditions. **CVE-2026-4922** is a cross-site request forgery flaw (`CWE-352`) that could let an attacker trigger GraphQL mutations as an authenticated user, while **CVE-2026-5262** is a cross-site scripting issue (`CWE-79`) that could expose tokens in the Storybook development environment. GitLab also fixed **CVE-2026-5816**, an improper path validation flaw (`CWE-41`) that could allow arbitrary JavaScript execution in a victim’s browser session. The issues affect multiple GitLab CE/EE release lines, with patched versions identified as **18.9.6**, **18.10.4**, and **18.11.1** depending on the flaw. CVE-2026-4922 affects versions from `17.0` before `18.9.6`, `18.10` before `18.10.4`, and `18.11` before `18.11.1`; CVE-2026-5262 affects versions from `16.1.0` before `18.9.6`, `18.10` before `18.10.4`, and `18.11` before `18.11.1`; and CVE-2026-5816 affects `18.10` before `18.10.4` and `18.11` before `18.11.1`. The vulnerabilities carry CVSS v3.1 ratings reflecting high confidentiality and integrity impact, and GitLab linked the disclosures to its patch release notice, internal work items, and HackerOne reports.
Jun 29, 2026
GitLab released security updates for **GitLab Community Edition (CE)** and **Enterprise Edition (EE)**, shipping patched versions **18.9.2**, **18.8.6**, and **18.7.6** to address multiple vulnerabilities affecting self-managed deployments. The Canadian Centre for Cyber Security issued advisory **AV26-222** urging organizations to review GitLab’s upstream advisory and apply the updates for any instances running versions prior to those releases. The update fixes **15 security issues**, including a high-severity **XSS** vulnerability (**CVE-2026-1090**, CVSS 8.7) in Markdown placeholder processing when the relevant feature flag is enabled, which could allow an authenticated attacker to inject malicious JavaScript into a victim’s browser. GitLab also addressed several **denial-of-service** conditions, including issues impacting the **GraphQL API** (resource exhaustion via recursion), repository archive endpoints, and JSON payload validation in the protected branches API; additional fixes include webhook-related DoS risks (e.g., **CVE-2025-13690**, **CVE-2025-12576**) and a **CRLF sequence** handling issue (**CVE-2026-3848**).
Jun 29, 2026
GitLab released out-of-band security updates for self-managed Community Edition and Enterprise Edition instances to fix **CVE-2026-19478**, a critical GraphQL directive flaw that can let an unauthenticated remote attacker modify or delete public projects and user data under certain conditions. The vulnerability, classified as **CWE-94** and rated **CVSS 9.4**, affects versions from `18.2` before `18.11.11`, `19.0` before `19.0.8`, `19.1` before `19.1.6`, and `19.2` before `19.2.4`. GitLab also fixed **CVE-2026-19650**, a high-severity cross-site request forgery issue in the GraphQL multiplex query handler that could allow unauthenticated mutation execution via `GET` requests with user interaction. Patched releases are **19.2.4**, **19.1.6**, **19.0.8**, and **18.11.11**; **GitLab.com** and **GitLab Dedicated** were already remediated and require no customer action. GitLab urged affected self-managed customers to upgrade immediately, and reporting indicated no disclosed in-the-wild exploitation or public exploit code at the time of release.
Sep 2, 2026