Skip to content
OpenAdvisories
High WID-SEC-2026-3556 11 CVEs

GitLab: Mehrere Schwachstellen

Published Sep 23, 2026 · Updated Nov 9, 2026 · Revision 5 · de

Vendor: Red Hat Vendor: RESF Product: Enterprise Linux Product: Rocky Linux Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen, um Daten zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 11

  • Critical 9.9
    CVE-2026-89078

    Double Free in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due…

    GitLab GitLab ruby gitlab-runner-19.2 Web / CMS Debian Alpine Wolfi
  • Critical 9.9
    CVE-2026-93577

    Integer Overflow or Wraparound in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due…

    GitLab GitLab ruby gitlab-runner-19.2 Web / CMS Debian Alpine Wolfi
  • High 8.7
    CVE-2026-84739

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of…

    GitLab GitLab Web / CMS
  • High 7.7
    CVE-2026-92470

    Missing Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-…

    GitLab GitLab Web / CMS
  • Medium 5.4
    CVE-2026-92874

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with an MCP-scoped token to perform actions beyond…

    GitLab GitLab gitlab-runner-helper-19.2 gitlab-runner-19.2 Web / CMS Wolfi
  • Medium 4.3
    CVE-2026-10518

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security…

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2026-8937

    Missing Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to read private child issue contents, including ti…

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2026-92529

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass admin-confi…

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2026-92530

    Use of Less Trusted Source in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute co…

    GitLab GitLab gitlab-runner-19.2 gitlab-runner-helper-19.2 Web / CMS Wolfi
  • Low 3.7
    CVE-2026-4523

    Missing Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sen…

    GitLab GitLab Web / CMS
  • Low 3.1
    CVE-2026-92628

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned …

    GitLab GitLab gitlab-runner-19.2 gitlab-runner-helper-19.2 Web / CMS Wolfi

Revision history

  1. #5

    Neue Updates von Red Hat aufgenommen

  2. #4

    Neue Updates von Red Hat aufgenommen

  3. #3

    Neue Updates von Red Hat aufgenommen

  4. #2

    Referenz(en) aufgenommen: EUVD-2026-88690, EUVD-2026-88689, EUVD-2026-88688, EUVD-2026-88687

  5. #1

    Initiale Fassung

References