Loading vulnerability…
SAML SSO Sign-In Restriction Bypass in GitLab CE/EE
CVE-2026-12910 is an authentication-enforcement vulnerability in GitLab Community Edition and Enterprise Edition. Missing checks in SAML SSO sign-in restriction enforcement can, under certain conditions, allow an authenticated user to authenticate without completing the required SSO flow. Affected versions are 18.6 through versions before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated attacker can circumvent configured SAML SSO sign-in restrictions, undermining the intended identity-provider authentication controls. The vulnerability has a CVSS v3.0 score of 5.4, with low confidentiality and integrity impact and no availability impact.
If you can’t patch tonight, do this now.
No specific vendor workaround is identified. Until the upgrade is complete, restrict GitLab access to trusted users and networks using compensating access controls, review authentication and SAML SSO configuration, and monitor for authentication events that bypass expected SSO flows. These measures do not replace the security update.
Patch, then assume compromise.
Upgrade GitLab CE/EE to version 19.1.8, 19.2.6, 19.3.2, or a later fixed release appropriate to the deployed release branch. Follow GitLab's architecture-specific upgrade procedures, including required upgrade stops and database migrations.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.