Loading vulnerability…
GitLab Terraform State Upload Improper Input Validation
CVE-2026-3855 is an improper input-validation vulnerability in the Terraform state upload functionality of GitLab Community Edition and Enterprise Edition. Insufficient validation of upload parameters can, under certain conditions, permit an authenticated user holding project-level permissions to access restricted file contents on the GitLab server or cause denial of service. Affected versions are 18.2.7 through versions before 19.1.8, 19.2 through versions before 19.2.6, and 19.3 through versions before 19.3.2.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated project-level user may disclose restricted server-side file contents, with a low confidentiality impact indicated by the reported CVSS vector. The flaw may also cause a denial of service under unspecified conditions.
If you can’t patch tonight, do this now.
Until patched, restrict project-level access to trusted users, limit use of Terraform state upload functionality where operationally feasible, and monitor for anomalous Terraform state upload activity and service instability.
Patch, then assume compromise.
Upgrade GitLab CE/EE to 19.1.8, 19.2.6, or 19.3.2, as applicable to the deployed release branch, or to a later release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.