widely-deployed-product-advisoryinternet-facing-service-vulnerabilityoperational-disruptionidentity-authentication-vulnerability

GitLab Patches XSS and Unauthenticated DoS Flaws in Self-Managed CE and EE

Patch & Detection Intelligence · 3 sources · Updated 4mo ago · First seen May 14, 2026

GitLab issued emergency security updates for self-managed Community Edition and Enterprise Edition instances to fix multiple high-severity vulnerabilities, including several cross-site scripting (XSS) flaws and unauthenticated denial-of-service (DoS) issues. The XSS bugs could allow attackers to run malicious JavaScript in users’ browsers, potentially leading to session hijacking, token theft, and repository manipulation, while the DoS flaws could disrupt CI/CD pipelines and broader workflow operations.

The affected products are GitLab CE and EE versions earlier than 18.11.3, 18.10.6, and 18.9.7, and administrators were urged to review GitLab’s release guidance and upgrade immediately to those patched versions. GitLab said its cloud-hosted platforms had already been remediated, while self-hosted operators were warned that single-node upgrades require downtime because of database migrations, whereas multi-node deployments can follow standard zero-downtime upgrade procedures.

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · May 13, 2026 – May 14, 2026

May 14, 20266mo ago
Canadian Centre for Cyber Security issues GitLab advisory
On 2026-05-14, the Canadian Centre for Cyber Security published advisory AV26-467 warning about the GitLab CE and EE vulnerabilities. It directed users and administrators to review GitLab's release information and apply updates to versions 18.11.3, 18.10.6, or 18.9.7.
May 13, 20266mo ago
GitLab discloses XSS and unauthenticated DoS impact details
GitLab said the patched flaws included multiple high-severity cross-site scripting issues that could enable malicious JavaScript execution, session hijacking, token theft, and repository manipulation, as well as unauthenticated denial-of-service issues that could disrupt CI/CD and workflow operations. GitLab also noted that its cloud-hosted platforms had already been patched and urged self-managed administrators to upgrade immediately.
May 13, 20266mo ago
GitLab releases security updates for CE and EE vulnerabilities
On 2026-05-13, GitLab published a security advisory and emergency patch releases for vulnerabilities affecting self-managed GitLab Community Edition and Enterprise Edition instances. The remediation versions were 18.11.3, 18.10.6, and 18.9.7 for affected installations running earlier releases.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

7 linked

Unauthenticated DoS in GitLab CI/CD Job Update API (CVE-2026-1659)Stored XSS in GitLab EE Analytics Dashboard Chart Rendering (CVE-2026-7481)Improper Authorization in GitLab GraphQL token scope (CVE-2026-1322)Unauthenticated DoS in GitLab API endpoints (CVE-2025-14869)Unauthenticated DoS in GitLab Duo Workflows API (CVE-2025-14870)XSS in GitLab EE Duo Agent output rendering (CVE-2026-6073)XSS in GitLab Global Search (CVE-2026-5297)

Affected products

3 linked

GitlabGitlab Community EditionGitlab Enterprise Edition

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Ca CcsNews · May 14, 2026

GitLab security advisory (AV26-467) - Canadian Centre for Cyber SecurityOpen source ↗

Cyber Security NewsNews · May 14, 2026

Critical GitLab Vulnerabilities Enables XSS and Unauthenticated DoS AttacksOpen source ↗

Docs GitlabNews · Oct 1, 2018

GitLab Patch Release: 18.11.3, 18.10.6, 18.9.7 | GitLab DocsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

GitLab Patches XSS and Unauthenticated DoS Flaws in Self-Managed CE and EE

How this story unfolded

Canadian Centre for Cyber Security issues GitLab advisory

GitLab discloses XSS and unauthenticated DoS impact details

GitLab releases security updates for CE and EE vulnerabilities

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

GitLab patches high-severity XSS and other flaws in CE and EE

GitLab patches five flaws including high-severity XSS in CE and EE

GitLab patches high-severity XSS and authorization bypass flaws in CE/EE

GitLab Patches XSS and Unauthenticated DoS Flaws in Self-Managed CE and EE

How this story unfolded

Canadian Centre for Cyber Security issues GitLab advisory

GitLab discloses XSS and unauthenticated DoS impact details

GitLab releases security updates for CE and EE vulnerabilities

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

GitLab patches high-severity XSS and other flaws in CE and EE

GitLab patches five flaws including high-severity XSS in CE and EE

GitLab patches high-severity XSS and authorization bypass flaws in CE/EE