[NEW] [high] GitLab: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in GitLab to execute arbitrary code, perform a denial of service attack, manipulate data, and bypass security measures.
CSIRTS triage
- What
- Multiple vulnerabilities allow code execution, denial of service, data manipulation, and security bypass.
- Who is affected
- GitLab deployments running vulnerable versions identified by CVEs.
- Urgency
- High severity with code execution and denial of service capabilities; patch urgently.
- Action
- Apply GitLab security updates addressing CVE-2025-10903, CVE-2026-15387, CVE-2026-18252, CVE-2026-3035, CVE-2026-4398, CVE-2026-7487, and CVE-2026-77801.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch GitLab
Get an email when a new GitLab advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3029
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2025-10903 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-15387 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-18252 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-3035 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-4398 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-7487 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-77801 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- lowCVE-2026-7487: GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.…nvd
- mediumCVE-2026-77801: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7,…nvd
- mediumCVE-2026-3035: GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.…nvd
- highCVE-2026-18252: GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19…nvd
- mediumCVE-2026-15387: GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19…nvd
- mediumCVE-2025-10903: GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 1…nvd
- criticalGitLab Patch Release: 19.3.1, 19.2.5, 19.1.7gitlab
- unknownMultiple vulnerabilities in GitLab (August 26, 2026)cert-fr-avis
Recent advisories for GitLab
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- lowCVE-2026-7487: GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.…nvd · 2026-08-26
- mediumCVE-2026-77801: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7,…nvd · 2026-08-26
- mediumCVE-2026-3035: GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.…nvd · 2026-08-26
- highCVE-2026-18252: GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19…nvd · 2026-08-26
- mediumCVE-2026-15387: GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19…nvd · 2026-08-26
- mediumCVE-2025-10903: GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 1…nvd · 2026-08-26
More from CERT-Bund (BSI) Security Advisories
- high[NEW] [high] FreeBSD Project FreeBSD OS: Multiple vulnerabilities2026-08-26
- low[NEW] [low] Insyde UEFI Firmware: Vulnerability allows unspecified attack2026-08-26
- medium[NEW] [medium] OPNsense: Vulnerability allows bypass of security measures2026-08-26
- high[NEW] [high] DNN: Multiple vulnerabilities2026-08-26
- medium[NEW] [medium] SQLite: Vulnerability allows denial of service2026-08-26