CVE-2026-4398

criticalcovered by 3 sourcesfirst seen 2026-08-26

An attacker can exploit multiple vulnerabilities in GitLab to execute arbitrary code, perform a denial of service attack, manipulate data, and bypass security measures.

CSIRTS triage

What: Multiple vulnerabilities allow code execution, denial of service, data manipulation, and security bypass.
Who is affected: GitLab deployments running vulnerable versions identified by CVEs.
Urgency: High severity with code execution and denial of service capabilities; patch urgently.
Action: Apply GitLab security updates addressing CVE-2025-10903, CVE-2026-15387, CVE-2026-18252, CVE-2026-3035, CVE-2026-4398, CVE-2026-7487, and CVE-2026-77801.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-4398

Get an email if CVE-2026-4398 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (3)

high[NEW] [high] GitLab: Multiple vulnerabilitiescert-bund · 2026-08-26
criticalGitLab Patch Release: 19.3.1, 19.2.5, 19.1.7gitlab · 2026-08-26
unknownMultiple vulnerabilities in GitLab (August 26, 2026)cert-fr-avis · 2026-08-26

External references

NVD record for CVE-2026-4398

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-4398 status](https://www.csirts.com/badge/CVE-2026-4398)](https://www.csirts.com/cve/CVE-2026-4398)