GitLab has issued an urgent security update to neutralise a massive wave of vulnerabilities.
Threat actors could exploit these newly disclosed flaws to silently hijack developer sessions or completely paralyze continuous integration pipelines with unauthenticated attacks.
On May 13, 2026, GitLab released critical patch versions 18.11.3, 18.10.6, and 18.9.7 for both its Community Edition (CE) and Enterprise Edition (EE). This comprehensive security sweep resolves 25 distinct vulnerabilities, with a heavy focus on high-impact Cross-Site Scripting (XSS) and Denial-of-Service (DoS) exploits.
Administrators of self-managed instances must apply these updates immediately, as these flaws expose sensitive codebases and internal workflows to severe compromise.
The most alarming vulnerabilities in this patch cycle are four high-severity XSS bugs, each carrying a critical CVSS score of 8.7.
These flaws stem from improper input sanitization across heavily used GitLab features, including the Analytics dashboard, global search functions, and Duo Agent output rendering.
If exploited, an authenticated attacker with standard permissions could execute arbitrary JavaScript in other users’ browsers.
A malicious insider or a compromised developer account could weaponize this to quietly hijack active sessions, steal authentication tokens, or manipulate repositories without triggering immediate security alarms.
Beyond script injection, GitLab addressed three severe DoS vulnerabilities (CVSS 7.5) that can be exploited without authentication. By sending specially crafted requests or malformed JSON payloads to the CI/CD job update API, Duo Workflows API, or internal API endpoints, attackers can trigger massive server resource consumption.
This allows external threat actors to deliberately crash development servers from afar, halting a company’s software delivery pipeline and causing costly operational downtime.
The patch also remediates a slew of medium-severity access control and authorization flaws. Notably, an improper authorization issue in GraphQL (CVE-2026-1322) allowed users with limited token scopes to create and comment on issues in private projects.
Other fixed issues include a CSRF vulnerability in JiraConnect subscriptions, unauthorized access to private debugging symbols in the NuGet Symbol Server, and the ability for standard developers to bypass package protection rules.
| CVE ID | Type / Short Title | Impacted Product / Area | Severity |
|---|---|---|---|
| CVE-2026-7481 | XSS in analytics dashboard chart rendering | GitLab EE Analytics dashboard charts | High |
| CVE-2026-5297 | XSS in global search | GitLab CE/EE global search | High |
| CVE-2026-6073 | XSS in Duo Agent output rendering | GitLab EE Duo Agent output | High |
| CVE-2026-7377 | XSS in customizable analytics dashboard | GitLab EE Analytics dashboards | High |
| CVE-2026-1659 | DoS in CI/CD job update API | GitLab CE/EE CI/CD job update API | High |
| CVE-2025-14870 | DoS in Duo Workflows API | GitLab CE/EE Duo Workflows API | High |
| CVE-2025-14869 | DoS in internal API endpoints | GitLab CE/EE internal API | High |
| CVE-2026-1322 | Improper authorization in GraphQL token scope enforcement | GitLab CE/EE GraphQL (read_api OAuth) | Medium |
| CVE-2026-1184 | DoS in Insights configuration | GitLab EE Insights configuration | Medium |
| CVE-2026-4524 | Access control issue in Issues API | GitLab CE/EE Issues API (confidential issues) | Medium |
| CVE-2026-8280 | DoS in direct transfer CSV parser | GitLab CE/EE direct transfer CSV parser | Medium |
| CVE-2026-4527 | CSRF in JiraConnect subscriptions | GitLab CE/EE JiraConnect | Medium |
| CVE-2026-3160 | Confused Deputy in Jira integration | GitLab CE/EE Jira integration | Medium |
| CVE-2026-6335 | XSS in Banzai markdown sanitizer | GitLab CE/EE markdown sanitizer | Medium |
| CVE-2025-12669 | XSS in achievement email notifications | GitLab CE/EE email notifications | Medium |
| CVE-2026-3607 | Access control in Helm package upload | GitLab CE/EE Helm package uploads | Medium |
| CVE-2026-3074 | Improper access control in NuGet Symbol Server | GitLab CE/EE NuGet Symbol Server | Medium |
| CVE-2026-1338 | Improper access control in Container Registry protected tags | GitLab CE/EE Container Registry | Medium |
| CVE-2026-8144 | Missing authorization in group user search | GitLab CE/EE group user search | Medium |
| CVE-2026-6063 | Improper access control in code owner approval rules | GitLab EE code owner approval | Medium |
| CVE-2026-3073 | Access control in PyPI Package Protection Rules | GitLab CE/EE PyPI package rules | Medium |
| CVE-2025-13874 | Improper access control in issue links API | GitLab CE/EE issue links API | Medium |
| CVE-2026-7471 | SSRF in virtual registry redirect handler | GitLab EE virtual registry | Low |
| CVE-2026-2900 | Access control in GraphQL approval rule mutations | GitLab EE approval rule GraphQL | Low |
| CVE-2026-6883 | Missing authorization in Security Policy Project Reassignment | GitLab EE security policy reassignment | Low |
GitLab.com users are already protected, as the cloud platform is currently running the patched versions. However, organizations relying on self-managed deployments of GitLab CE and EE remain exposed.
System administrators must upgrade their instances to versions 18.11.3, 18.10.6, or 18.9.7 immediately to secure their development infrastructure against these critical attack vectors.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
WhatsApp and Telegram users in India may face access restrictions starting January 1, 2027, as…
StealC’s seller has resurfaced with Stadia, a modular remote access trojan that expands the disrupted…
A critical command execution vulnerability has been identified in Okta Access Gateway (OAG), which could…
Hewlett Packard Enterprise (HPE) has addressed a critical authentication-bypass vulnerability in the SSH daemon of…
Capcom has confirmed a data breach that affects 11,774,247 CAPCOM ID records worldwide. An unauthorized…
Quest Diagnostics disclosed unauthorized access to its Quanum LSM system, confirming that an unidentified party…