Loading story…
GitLab released emergency security updates across multiple CE and EE versions to fix CVE-2024-45409, a critical SAML authentication bypass affecting self-managed instances configured for SAML-based sign-in. The company said the issue was mitigated by updating omniauth-saml to 2.2.1 and ruby-saml to 1.17.0, and urged administrators to upgrade immediately to patched releases spanning the 17.x and 16.x branches. GitLab.com and GitLab Dedicated were already remediated and were not exposed in the same way.
GitLab also published mitigation and threat-hunting guidance for organizations that could not patch immediately, including enforcing GitLab two-factor authentication for all users and disabling the SAML two-factor bypass option. To help defenders identify attempted or successful exploitation, the advisories pointed to review of application_json and auth_json logs and shared Sigma-style detection ideas focused on anomalous extern_uid values and suspicious IP mismatches during authentication events.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On 2024-09-17, GitLab released security patch versions 17.3.3, 17.2.7, 17.1.8, 17.0.8, and 16.11.10 to fix the critical SAML authentication bypass tracked as CVE-2024-45409. GitLab said GitLab.com and GitLab Dedicated were already remediated and urged self-managed customers using SAML to upgrade immediately.
On 2024-09-25, GitLab released multiple additional 16.x patch versions, including 16.10.10 through 16.0.10, to backport the security fix for the critical SAML authentication bypass CVE-2024-45409. The advisory noted the fix updated omniauth-saml to 2.2.1 and ruby-saml to 1.17.0, and included mitigation and log-hunting guidance for self-managed instances.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
docs.gitlab.com
Open sourcedocs.gitlab.com
Open sourceabout.gitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released security updates for self-managed **GitLab Community Edition (CE)** and **Enterprise Edition (EE)** to fix a high-severity **two-factor authentication (2FA) bypass** and multiple **denial-of-service (DoS)** flaws. The most significant issue, **CVE-2026-0723** (CVSS 7.4), is an *unchecked return value* weakness in authentication services that could allow an attacker with knowledge of a victim’s credential/account ID to bypass 2FA by submitting forged device responses. GitLab also patched DoS vulnerabilities affecting unauthenticated and authenticated scenarios, including crafted malformed authentication data against the **Jira Connect** integration (**CVE-2025-13927**), incorrect authorization validation in API endpoints such as the **Releases API** (**CVE-2025-13928**), malformed Wiki documents that bypass cycle detection (**CVE-2025-13335**), and repeated malformed SSH authentication requests (**CVE-2026-1102**). Fixed releases are **18.8.2**, **18.7.2**, and **18.6.4**; GitLab advised administrators to upgrade immediately, noting *GitLab.com* is already patched, while third-party tracking indicated thousands of exposed GitLab CE instances remain online and potentially at risk if unpatched.
Jun 29, 2026
GitLab released emergency updates for GitLab CE and EE to fix nine vulnerabilities, including two critical authentication flaws in the third-party `ruby-saml` library that can let an attacker impersonate arbitrary users in SAML SSO deployments. The issues, tracked as `CVE-2025-25291` and `CVE-2025-25292`, stem from SAML parser differential behavior that can enable a valid SAML-signing party to bypass authentication checks and effectively sign in as another user. GitHub security researchers disclosed the underlying SAML weakness, describing how parser inconsistencies can break trust assumptions in SSO authentication flows.
Jul 24, 2026
GitLab released patched Community Edition and Enterprise Edition versions `18.8.2`, `18.7.2`, and `18.6.4` to remediate five disclosed vulnerabilities affecting self-managed deployments. The fixes include a high-severity two-factor authentication bypass issue and four denial-of-service flaws, two rated high severity and two rated medium severity. Related CVE records were published for `CVE-2026-0723`, `CVE-2025-13927`, `CVE-2026-1102`, `CVE-2025-13335`, and `CVE-2025-13928`. GitLab said GitLab.com was already running the patched version and that GitLab Dedicated customers did not need to take action, but urged self-managed customers to upgrade immediately. The company also warned that the patch release includes database migrations that can cause downtime on single-node instances unless operators use zero-downtime upgrade procedures in multi-node environments.
Jul 24, 2026