Loading vulnerability…
Exposed Method in GitLab CE/EE WebSocket Connections
CVE-2026-5173 is an improper access control vulnerability in GitLab Community Edition and Enterprise Edition WebSocket connection handling. Affected versions allow an authenticated user, including a low-privilege user, to invoke unintended internal server-side methods over WebSocket connections because the WebSocket handler does not adequately restrict which methods may be called. The issue affects GitLab CE/EE versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3. The vulnerability is classified as CWE-749 because internal functionality was exposed through a reachable interface without sufficient method-level authorization checks.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can let an authenticated attacker bypass intended authorization boundaries in the WebSocket layer and reach internal server-side functionality that should not be exposed to that user. Reported consequences include access to sensitive data and limited unauthorized modification of data. The published CVSS v3.1 vector indicates high confidentiality impact, low integrity impact, no direct availability impact, and changed scope.
If you can’t patch tonight, do this now.
No vendor-supported workaround or temporary mitigation has been documented for this vulnerability beyond applying the official patches. Where immediate patching is not possible, reducing exposure of GitLab to untrusted authenticated users may lower risk, but the available information indicates that upgrading is the only confirmed mitigation.
Patch, then assume compromise.
Upgrade affected self-managed GitLab CE/EE installations to a fixed release. GitLab remediated the issue in versions 18.8.9, 18.9.5, and 18.10.3 by restricting which methods can be invoked through the WebSocket connection handler. Applying one of these vendor-provided patched versions is the supported remediation.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.