Loading story…
GitLab released emergency updates for GitLab CE and EE to fix nine vulnerabilities, including two critical authentication flaws in the third-party ruby-saml library that can let an attacker impersonate arbitrary users in SAML SSO deployments. The issues, tracked as CVE-2025-25291 and CVE-2025-25292, stem from SAML parser differential behavior that can enable a valid SAML-signing party to bypass authentication checks and effectively sign in as another user. GitHub security researchers disclosed the underlying SAML weakness, describing how parser inconsistencies can break trust assumptions in SSO authentication flows.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On March 19, 2025, CSIRT.SK published an advisory highlighting that the patched GitLab vulnerabilities could be exploited for arbitrary user impersonation via SAML SSO and remote code execution via the Direct Transfer feature. The notice urged immediate upgrades and listed mitigations such as enforcing 2FA, disabling SAML 2FA bypass, requiring admin approval for new users, and disabling Direct Transfer.
On March 12, 2025, GitLab released versions 17.9.2, 17.8.5, and 17.7.7 for CE and EE to fix multiple security issues. The release addressed critical ruby-saml flaws CVE-2025-25291 and CVE-2025-25292, as well as critical GraphQL remote code execution flaw CVE-2025-27407, and GitLab said GitLab.com was already patched.
GitHub security researchers reported vulnerabilities CVE-2025-25291 and CVE-2025-25292 in the third-party ruby-saml library. The flaws can allow authentication bypass and user impersonation in SAML SSO deployments due to parser differentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcegithub.blog
Open sourcedocs.gitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released emergency security updates across multiple CE and EE versions to fix **CVE-2024-45409**, a critical SAML authentication bypass affecting self-managed instances configured for SAML-based sign-in. The company said the issue was mitigated by updating `omniauth-saml` to `2.2.1` and `ruby-saml` to `1.17.0`, and urged administrators to upgrade immediately to patched releases spanning the 17.x and 16.x branches. GitLab.com and GitLab Dedicated were already remediated and were not exposed in the same way. GitLab also published mitigation and threat-hunting guidance for organizations that could not patch immediately, including enforcing GitLab two-factor authentication for all users and disabling the SAML two-factor bypass option. To help defenders identify attempted or successful exploitation, the advisories pointed to review of `application_json` and `auth_json` logs and shared Sigma-style detection ideas focused on anomalous `extern_uid` values and suspicious IP mismatches during authentication events.
Jul 24, 2026
GitLab released **19.0.2**, **18.11.5**, and **18.10.8** for self-managed Community Edition and Enterprise Edition deployments to fix **11 security vulnerabilities** and additional bugs, and urged administrators to upgrade immediately. The advisory says all versions before those releases are affected, while **GitLab.com** has already been patched and **GitLab Dedicated** customers do not need to take action. GitLab also warned that the update includes database migrations that may cause downtime on single-node instances, though multi-node environments can use zero-downtime upgrade procedures. The most severe issue, **`CVE-2026-6552`** (**CVSS 8.7**), is an improper authorization flaw in GitLab EE's Group SAML identity management that could let an authenticated **group Owner** take over another group member's account under certain conditions. GitLab also fixed **`CVE-2026-10087`**, an Analytics Dashboard cross-site scripting flaw in GitLab EE that could allow an authenticated **developer** to execute arbitrary client-side code in a victim's browser. The broader patch set addresses additional risks including denial of service in Grape API JSON parsing, SSRF, unauthorized access to confidential data, and other authorization bypasses, and government and vendor advisories have called on organizations to apply the patched versions.
Jul 25, 2026
GitLab released security updates for self-managed **GitLab Community Edition (CE)** and **Enterprise Edition (EE)** to fix a high-severity **two-factor authentication (2FA) bypass** and multiple **denial-of-service (DoS)** flaws. The most significant issue, **CVE-2026-0723** (CVSS 7.4), is an *unchecked return value* weakness in authentication services that could allow an attacker with knowledge of a victim’s credential/account ID to bypass 2FA by submitting forged device responses. GitLab also patched DoS vulnerabilities affecting unauthenticated and authenticated scenarios, including crafted malformed authentication data against the **Jira Connect** integration (**CVE-2025-13927**), incorrect authorization validation in API endpoints such as the **Releases API** (**CVE-2025-13928**), malformed Wiki documents that bypass cycle detection (**CVE-2025-13335**), and repeated malformed SSH authentication requests (**CVE-2026-1102**). Fixed releases are **18.8.2**, **18.7.2**, and **18.6.4**; GitLab advised administrators to upgrade immediately, noting *GitLab.com* is already patched, while third-party tracking indicated thousands of exposed GitLab CE instances remain online and potentially at risk if unpatched.
Jun 29, 2026