GitLab Addresses Multiple Vulnerabilities Linked to DoS and Code Injection

GitLab has rolled out a crucial security update to fix multiple vulnerabilities across its Community Edition (CE) and Enterprise Edition (EE) platforms.

Organizations utilizing self-managed GitLab instances are strongly advised by GitLab security experts to apply these updates immediately to prevent potential exploitation.

Customers utilizing GitLab Dedicated or the cloud-hosted GitLab.com services are already protected and require no manual intervention.

The most critical flaw addressed in this patch cycle is an exposed method vulnerability affecting websocket connections.

Tracked as CVE-2026-5173, this high-severity weakness could permit an authenticated attacker to invoke unintended server-side methods by bypassing proper access controls.

The newly released patches for versions 18.10.3, 18.9.5, and 18.8.9 address twelve distinct security flaws, including high-severity issues that could enable denial-of-service (DoS) attacks and unintended server-side actions.

Security researchers also identified two significant denial-of-service vulnerabilities. One flaw in the Terraform state lock API stems from improper input validation of JSON payloads.

At the same time, another allows unauthenticated threat actors to disrupt services by sending repeated, resource-intensive queries to the GraphQL API.

Alongside these high-severity bugs, the update resolves several medium-severity vulnerabilities affecting data integrity and user privacy.

Notably, developers fixed a code injection flaw within the Code Quality reports feature that could leak the IP addresses of users viewing specially crafted content.

Additional fixes address cross-site scripting (XSS) in customizable analytics dashboards, information disclosure risks in CSV exports, and improper access controls within the Environments API.

To maintain robust security hygiene, administrators must verify their current deployments and upgrade to the latest supported patch release.

Relying on outdated software leaves critical development infrastructure exposed to both authenticated malicious insiders and unauthenticated external threats.

CVE Vulnerability Details

CVE ID	Severity (CVSS)	Vulnerability Description	Impacted Products & Versions
CVE-2026-5173	High (8.5)	Exposed method in websocket connections allowing unintended server-side execution	CE/EE: 16.9.6 to 18.8.9, 18.9 to 18.9.5, 18.10 to 18.10.3
CVE-2026-1092	High (7.5)	Denial of Service in Terraform state lock API via malicious JSON payloads	CE/EE: 12.10 to 18.8.9, 18.9 to 18.9.5, 18.10 to 18.10.3
CVE-2025-12664	High (7.5)	Denial of Service in GraphQL API via repeated query submissions	CE/EE: 13.0 to 18.8.9, 18.9 to 18.9.5, 18.10 to 18.10.3
CVE-2026-1403	Medium (6.5)	Denial of Service in CSV import affecting Sidekiq workers	CE/EE: 11.7 to 18.8.9, 18.9 to 18.9.5, 18.10 to 18.10.3
CVE-2026-1101	Medium (6.5)	Denial of Service in GraphQL SBOM API due to poor validation	EE: 18.2 to 18.8.9, 18.9 to 18.9.5, 18.10 to 18.10.3
CVE-2026-1516	Medium (5.7)	Code Injection in Code Quality reports leaking user IP addresses	EE: 18.0.0 to 18.8.9, 18.9 to 18.9.5, 18.10 to 18.10.3
CVE-2026-4332	Medium (5.4)	Cross-site Scripting (XSS) in customizable analytics dashboards	EE: 18.2 to 18.8.9, 18.9 to 18.9.5, 18.10 to 18.10.3
CVE-2026-2619	Medium (4.3)	Incorrect Authorization modifying vulnerability flag data in private projects	EE: 18.6 to 18.8.9, 18.9 to 18.9.5, 18.10 to 18.10.3
CVE-2025-9484	Medium (4.3)	Information Disclosure exposing user email addresses via GraphQL	EE: 16.6 to 18.8.9, 18.9 to 18.9.5, 18.10 to 18.10.3
CVE-2026-1752	Medium (4.3)	Improper Access Control in Environments API modifying protected settings	EE: 11.3 to 18.8.9, 18.9 to 18.9.5, 18.10 to 18.10.3
CVE-2026-2104	Medium (4.3)	Information Disclosure in CSV export exposing confidential issues	CE/EE: 18.2 to 18.8.9, 18.9 to 18.9.5, 18.10 to 18.10.3
CVE-2026-4916	Low (2.7)	Missing Authorization in custom role permissions enabling demotions	CE/EE: 18.2 to 18.8.9, 18.9 to 18.9.5, 18.10 to 18.10.3

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.