Skip to content
OpenAdvisories
Critical 1 exploited CVE WID-SEC-2026-3858 24 CVEs

GitLab: Mehrere Schwachstellen

Published Oct 11, 2026 · Updated Nov 9, 2026 · Revision 7 · de

Vendor: Red Hat Vendor: RESF Product: Enterprise Linux Product: Rocky Linux Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen, um Daten zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 24

  • Critical 10.0
    CVE-2026-97229 Exploited Public exploit Scanner template EPSS 69%

    Integer Overflow or Wraparound in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server…

    GitLab GitLab gitlab ruby Web / CMS Debian Ubuntu Azure Linux Alpine Wolfi
    KEV Oct 29, 2026
  • High 8.7
    CVE-2026-92883

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context o…

    GitLab GitLab gitlab gitlab-runner-helper-19.2 Web / CMS Ubuntu Wolfi
  • High 8.5
    CVE-2026-16301

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines o…

    GitLab GitLab gitlab gitlab-runner-helper-19.2 Web / CMS Ubuntu Wolfi
  • High 8.2
    CVE-2026-14814

    Permissive Regular Expression in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted use…

    GitLab GitLab gitlab gitlab-runner-helper-19.2 Web / CMS Ubuntu Wolfi
  • High 7.7
    CVE-2026-81839

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferr…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.3
    CVE-2026-96893

    Improper Neutralization of Input Used for LLM Prompting in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent i…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.2
    CVE-2026-101168

    Insertion of Sensitive Information into Log File in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with access to GitLab Pages log data to obtain a…

    GitLab GitLab gitlab gitlab-runner-helper-19.2 Web / CMS Ubuntu Wolfi
  • Medium 5.8
    CVE-2026-7767

    URL Redirection to Untrusted Site ('Open Redirect') in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensiti…

    GitLab GitLab gitlab gitlab-runner-helper-19.2 Web / CMS Ubuntu Wolfi
  • Medium 5.3
    CVE-2026-16275

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read confidential notes on public projects …

    GitLab GitLab gitlab gitlab-runner-helper-19.2 Web / CMS Ubuntu Wolfi
  • Medium 5.3
    CVE-2026-84284

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, 19.3 before 19.3.6, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private group…

    GitLab GitLab gitlab gitlab-runner-19.2 Web / CMS Ubuntu Wolfi
  • Medium 5.3
    CVE-2026-85529

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidential system…

    GitLab GitLab gitlab gitlab-runner-helper-19.2 Web / CMS Ubuntu Wolfi
  • Medium 4.6
    CVE-2026-100755

    Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain deployment configurations, could have allowed an authenticated user to poison cached page content ser…

    GitLab GitLab gitlab gitlab-runner-helper-19.2 Web / CMS Ubuntu Wolfi
  • Medium 4.3
    CVE-2026-104661

    Incorrect Privilege Assignment in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a custom role with compliance framework adm…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2026-105458

    Reliance on Untrusted Inputs in a Security Decision in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a specific granular permission to obtain a …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2026-14210

    Insufficient Granularity of Access Control in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a project-scoped fine-grained Personal Acc…

    GitLab GitLab gitlab gitlab-runner-helper-19.2 Web / CMS Ubuntu Wolfi
  • Medium 4.3
    CVE-2026-14552

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Guest access to read confidential epic cont…

    GitLab GitLab gitlab gitlab-runner-helper-19.2 Web / CMS Ubuntu Wolfi
  • Medium 4.3
    CVE-2026-6567

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.8 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with reporter role to access restricted CI artif…

    GitLab GitLab gitlab gitlab-runner-helper-19.2 Web / CMS Ubuntu Wolfi
  • Medium 4.2
    CVE-2026-5954

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to download package files from a public project due to improper…

    GitLab GitLab gitlab gitlab-runner-19.2 Web / CMS Ubuntu Wolfi
  • Medium 4.2
    CVE-2026-78335

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a project-scoped fine-grained Personal A…

    GitLab GitLab gitlab gitlab-runner-helper-19.2 Web / CMS Ubuntu Wolfi
  • Medium 4.2
    CVE-2026-92528

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to approve a merge request despite having contribu…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.5
    CVE-2026-100104

    Server-Side Request Forgery (SSRF) in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach…

    GitLab GitLab gitlab gitlab-runner-helper-19.2 Web / CMS Ubuntu Wolfi
  • Low 3.1
    CVE-2026-82632

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a fine-grained Personal Access Token scoped…

    GitLab GitLab gitlab gitlab-runner-helper-19.2 Web / CMS Ubuntu Wolfi
  • Low 2.7
    CVE-2026-103549

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with maintainer-role permissions to remove certa…

    GitLab GitLab gitlab gitlab-runner-helper-19.2 Web / CMS Ubuntu Wolfi
  • Low 2.7
    CVE-2026-9268

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project CI/CD de…

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #7

    Neue Updates von Red Hat aufgenommen

  2. #6

    Neue Updates von Red Hat aufgenommen

  3. #5

    Korrektur 19.3.5

  4. #4

    Neue Updates von Red Hat aufgenommen

  5. #3

    PoC für CVE-2026-97229 aufgenommen

  6. #2

    Referenz(en) aufgenommen: EUVD-2026-98216, EUVD-2026-98230, EUVD-2026-98229, EUVD-2026-98228, EUVD-2026-98227, EUVD-2026-98226, EUVD-2026-98225, EUVD-2026-98224, EUVD-2026-98223, EUVD-2026-98222, EUVD-2026-98221, EUVD-2026-98220, EUVD-2026-98219, EUVD-2026-98218, EUVD-2026-98217, EUVD-2026-98215, EUVD-2026-98214, EUVD-2026-98213, EUVD-2026-98212, EUVD-2026-98211, EUVD-2026-98210, EUVD-2026-98209, EUVD-2026-98208, EUVD-2026-98207

  7. #1

    Initiale Fassung

References