GitLab Patches Code Execution, Information Disclosure Vulnerabilities

1. Executive summary

GitLab has released CE/EE security updates — versions 19.1.1, 19.0.3, and 18.11.6 — patching 13 vulnerabilities including three rated high severity. The most significant are CVE-2026-10086 (XSS in the Analytics Dashboard, requiring developer-role authentication), CVE-2026-10712 (XSS in the Web IDE workbench asset handler, exploitable by unauthenticated attackers), and CVE-2026-12053 (insufficient output filtering in Duo Workflows leading to sensitive information disclosure). No verified CVSS scores, CISA-KEV exploitation states, or MITRE actor profiles were resolved for this item; all severity assessments below are drawn from the vendor and advisory sources and should be treated as single-sourced pending independent confirmation. EMEA financial services running self-managed GitLab instances are exposed to client-side code execution and information disclosure; GitLab.com is already patched.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 17: ICT-related incident management process	Self-managed GitLab instances are in scope as ICT systems; the patched vulnerabilities (XSS enabling client-side code execution, DoS via API middleware, information disclosure) constitute ICT-related incidents if exploited.	Financial entities must ensure their incident management process covers detection, triage, and remediation of these GitLab vulnerabilities in self-managed deployments.
DORA Art. 28: ICT third-party risk — general principles	GitLab is an ICT third-party provider for self-managed deployments; the vulnerability set includes information disclosure and code execution flaws.	Entities should verify that their GitLab deployment is patched and that third-party risk assessments reflect this advisory.
NIS2 Art. 21(2)(d): supply chain security measures	GitLab is a component in the software supply chain; the vulnerabilities affect CI/CD-adjacent infrastructure (Web IDE, Analytics Dashboard, Duo Workflows).	Essential entities should assess and remediate GitLab instances as part of supply chain security measures.

3. Technical analysis & attack chain

Vulnerability inventory (13 total: 3 high, 7 medium, 3 unspecified)

High-severity vulnerabilities

CVE-2026-10086 — XSS in Analytics Dashboard (GitLab EE) - Affected versions: EE, all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, 19.0 before 19.0.2 - Mechanism: Improper input sanitization in the Analytics Dashboard allows an authenticated user with developer-role permissions to execute arbitrary client-side code on behalf of a targeted user. - Impact: Session hijacking, credential theft, unauthorized actions in victim's session context. - Source: GHSA-vcvx-j5vc-8jhr, SecurityWeek.
CVE-2026-10712 — XSS in Web IDE workbench asset handler (GitLab CE/EE) - Mechanism: Improper sanitization of user-supplied input in the Web IDE workbench asset handler allows unauthenticated attackers to execute JavaScript code in users' browser sessions. - Impact: Unauthenticated client-side code execution in victim's browser; session token theft, unauthorised repository access. - Source: SecurityWeek (single-sourced for the specific CVE assignment and Web IDE component detail; the GHSA advisories do not individually map to this CVE in the provided corpus).
CVE-2026-12053 — Insufficient output filtering in Duo Workflows (GitLab EE) - Affected versions: EE, all versions from 19.1 before 19.1.1 - Mechanism: Insufficient output filtering in Duo Workflows allows a user to access sensitive information already committed to a project. - Impact: Exposure of committed secrets, source code, or other sensitive project data to users who should not have access. - Source: GHSA-fwjq-556c-7hwm, SecurityWeek.

Medium-severity vulnerabilities (7)

The SecurityWeek source reports seven medium-severity flaws with the following impact categories:

Authorization bypass
Incorrect authorization
Insufficient filtering
Improper input validation
Improper access control
Settings tampering
Confidential information disclosure
DAST site profile secrets exfiltration
Sensitive information written to logs
Content concealment
Maven package metadata overwrite
Package metadata disclosure

Additional high-severity advisory items from GHSA corpus (not individually CVE-mapped in sources)

GHSA-fc6w-qm7g-jfwh — XSS in GitLab EE (all versions from 16.4 before 18.11.6, 19.0 before 19.0.3, 19.1 before 19.1.1): authenticated user with developer-role permissions can execute arbitrary client-side code in another user's session context due to improper sanitization of user-supplied input. This may be the same issue as CVE-2026-10086 or a distinct finding; the sources do not explicitly reconcile them.
GHSA-cx4g-hr74-m89m — DoS in GitLab CE/EE (all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, 19.0 before 19.0.2): unauthenticated user can cause denial of service due to improper input validation in API request parsing middleware.
GHSA-q9j8-24p8-jq8j — Unauthorized email addition (GitLab EE, all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, 19.0 before 19.0.2): authenticated user can add unauthorized email addresses to a targeted user's account due to improper sanitization in certain group setting fields. This enables account-takeover adjacent vectors (password reset via added email).

Attack chain (confirmed steps from source material)

Initial access — Attacker requires either: (a) no authentication (CVE-2026-10712 Web IDE XSS, GHSA-cx4g-hr74-m89m API DoS), or (b) authenticated access with developer-role permissions (CVE-2026-10086, GHSA-fc6w-qm7g-jfwh, GHSA-q9j8-24p8-jq8j).
Expitation — Attacker injects crafted input into the Analytics Dashboard, Web IDE workbench asset handler, or group setting fields. For Duo Workflows, a user accesses committed project content through insufficient output filtering.
Client-side execution — Malicious JavaScript executes in a victim's browser session context, enabling session token theft, CSRF token abuse, or unauthorised repository actions.
Information disclosure — Via Duo Workflows (CVE-2026-12053), sensitive committed data is exposed. Via DAST site profile secrets exfiltration (medium-severity), CI/CD pipeline secrets may be compromised.
Account takeover vector — Via GHSA-q9j8-24p8-jq8j, attacker adds an unauthorized email to a target account, enabling password reset flows.

Confidence caveat: The specific CVE-to-GHSA mapping is not explicitly reconciled across sources. CVE-2026-10712 and its Web IDE workbench asset handler detail are single-sourced (SecurityWeek only). No MITRE actor profiles were resolved — there is no attributed threat actor in any source. No CISA-KEV exploitation state is available. All severity ratings are vendor-sourced.

4. Mitigation & containment

P1 — Within 24 hours

Patch self-managed GitLab instances immediately. Upgrade to one of:
19.1.1 (if on 19.1 branch)
19.0.3 (if on 19.0 branch)
18.11.6 (if on 18.11 branch)
For older branches, upgrade to at minimum 18.10.8 (addresses CVE-2026-10086, GHSA-cx4g-hr74-m89m, GHSA-q9j8-24p8-jq8j).
GitLab.com is already patched — no action required for SaaS users.
Verify patch level: sudo gitlab-rails runner "puts Gitlab::VERSION.to_s" or check Admin Area → Components.

P2 — Within 72 hours

Restrict network exposure of self-managed GitLab instances to authenticated users only where feasible. Place GitLab behind VPN or IP-allow-list to reduce exposure of unauthenticated attack surfaces (CVE-2026-10712, GHSA-cx4g-hr74-m89m).
Review developer-role assignments. CVE-2026-10086 and GHSA-fc6w-qm7g-jfwh require developer-role access. Audit and reduce developer-role memberships to least-privilege.
Audit email addresses on all GitLab accounts to detect unauthorized additions (GHSA-q9j8-24p8-jq8j). Check: Admin Area → Users → each user's email list.
Review DAST site profile secrets — rotate any CI/CD secrets that may have been exposed via the medium-severity DAST site profile secrets exfiltration flaw.

P3 — Within 7 days

Deploy Content-Security Policy (CSP) headers on the GitLab instance to mitigate XSS impact for any residual unpatched instances or as defense-in-depth: configure Content-Security-Policy with script-src 'self' and appropriate nonce/hash directives.
Review GitLab audit logs for anomalous activity: Admin Area → Monitoring → Audit Logs. Look for: unexpected email additions, unusual API request patterns (DoS indicator), access to projects outside normal patterns (Duo Workflows disclosure).
Rotate session tokens and force re-authentication for all users if any exploitation is suspected.
Verify Duo Workflows access controls — ensure only authorized personnel have access to Duo Workflows features, and review any project content that may have been exposed.

5. Indicators of compromise

No indicators of compromise available in the source material. The sources describe vulnerability classes and affected components but do not provide specific IOCs (IPs, domains, hashes, file paths, or command-line artefacts) associated with exploitation.

6. Detection

The sources do not provide specific exploitation artefacts (malware hashes, C2 domains, command-line strings, registry keys, or file paths). However, the vulnerability details provide usable behavioural indicators for Sigma rules targeting GitLab audit log and web proxy logs.

Sigma rule — GitLab XSS exploitation via Analytics Dashboard or Web IDE

title: GitLab XSS Exploit Attempt in Analytics Dashboard or Web IDE
id: 6f8a-9c2d-4e1b-8a7f-0001
status: experimental
description: >
  Detects potential XSS exploitation targeting GitLab Analytics Dashboard (CVE-2026-10086)
  or Web IDE workbench asset handler (CVE-2026-10712). Monitors for suspicious script
  injection patterns in GitLab web requests.
references:

  - https://www.securityweek.com/gitlab-patches-code-execution-information-disclosure-vulnerabilities/
  - https://github.com/advisories/GHSA-vcvx-j5vc-8jhr
  - https://github.com/advisories/GHSA-fc6w-qm7g-jfwh
author: Adverse Trace
date: 2026-06-25
logsource:
  product: web
  service: gitlab
detection:
  selection:
    uri|contains:

      - "/analytics"
      - "/-/ide"
      - "workbench"
      - "asset_handler"
    request_body|contains:

      - "<script"
      - "javascript:"
      - "onerror="
      - "onload="
      - "onclick="
  condition: selection
falsepositives:

  - Legitimate use of JavaScript in GitLab analytics custom visualizations
  - Development activity in Web IDE
level: high

Sigma rule — GitLab unauthorized email addition (GHSA-q9j8-24p8-jq8j)

title: GitLab Unauthorized Email Addition to User Account
id: 6f8a-9c2d-4e1b-8a7f-0002
status: experimental
description: >
  Detects potential exploitation of GHSA-q9j8-24p8-jq8j where an authenticated user
  adds unauthorized email addresses to a targeted user's account via improper
  sanitization in group setting fields.
references:

  - https://github.com/advisories/GHSA-q9j8-24p8-jq8j
author: Adverse Trace
date: 2026-06-25
logsource:
  product: gitlab
  service: audit
detection:
  selection:
    action:

      - "user_email_added"
      - "user_email_create"
    entity_type: "Email"
  filter_legitimate:
    author_id|contains: "admin"
  condition: selection and not filter_legitimate
falsepositives:

  - Legitimate user adding a secondary email address
  - Administrative email management
level: medium

Sigma rule — GitLab API DoS via request parsing middleware (GHSA-cx4g-hr74-m89m)

title: GitLab API DoS via Malformed Request Parsing
id: 6f8a-9c2d-4e1b-8a7f-0003
status: experimental
description: >
  Detects potential denial-of service exploitation against GitLab API request parsing
  middleware (GHSA-cx4g-hr74-m89m) by unauthenticated users.
references:

  - https://github.com/advisories/GHSA-cx4g-hr74-m89m
author: Adverse Trace
date: 2026-06-25
logsource:
  product: web
  service: gitlab
detection:
  selection:
    uri|startswith:

      - "/api/v4/"
      - "/api/v1/"
    status:

      - 500
      - 502
      - 503
  timeframe: 1m
  condition: selection | count(uri) > 50
falsepositives:

  - Legitimate API load spikes
  - CI/CD pipeline bursts
level: medium

7. Sources

SecurityWeek — "GitLab Patches Code Execution, Information Disclosure Vulnerabilities" — https://www.securityweek.com/gitlab-patches-code-execution-information-disclosure-vulnerabilities/ — 2026-06-25
GitHub Security Advisories — GHSA-vcvx-j5vc-8jhr (Analytics Dashboard XSS, GitLab EE) — https://github.com/advisories/GHSA-vcvx-j5vc-8jhr
GitHub Security Advisories — GHSA-fc6w-qm7g-jfwh (Session XSS, GitLab EE) — https://github.com/advisories/GHSA-fc6w-qm7g-jfwh
GitHub Security Advisories — GHSA-cx4g-hr74-m89m (API DoS, GitLab CE/EE) — https://github.com/advisories/GHSA-cx4g-hr74-m89m
GitHub Security Advisories — GHSA-fwjq-556c-7hwm (Duo Workflows info disclosure, GitLab EE) — https://github.com/advisories/GHSA-fwjq-556c-7hwm
GitHub Security Advisories — GHSA-q9j8-24p8-jq8j (Unauthorized email addition, GitLab EE) — https://github.com/advisories/GHSA-q9j8-24p8-jq8j
BSI Germany (WID-SEC-2026-1682) — "Microsoft GitHub Enterprise: Mehrere Schwachheiten ermöglichen Offenlegung von Informationen" — https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1682

8. Adverse Trace position

Severity assessment: High. The vulnerability set includes unauthenticated XSS (CVE-2026-10712), authenticated XSS enabling session hijacking (CVE-2026-10086), information disclosure via Duo Workflows (CVE-2026-12053), unauthenticated DoS (GHSA-cx4g-hr74-m89m), and an account-takeover-adjacent vector via unauthorized email addition (GHSA-q9j8-24p8-jq8j). No verified CVSS scores or CISA-KEV exploitation states were available — all severity ratings are vendor-sourced and single-sourced for CVE-2026-10712. No threat actor attribution is present in any source; we treat attribution as unconfirmed and note that no MITRE actor profile was resolved.

Client-impact assessment: EMEA financial services running self-managed GitLab are directly exposed. The combination of XSS (session compromise), information disclosure (committed secrets), and DoS (API availability) creates risk to source code confidentiality, CI/CD pipeline integrity, and developer platform availability. GitLab.com SaaS users are not affected. The DAST site profile secrets exfiltration vector (medium-severity) is particularly relevant for financial entities using GitLab DAST scanning in CI/CD pipelines — secrets embedded in DAST profiles may have been exposed.

Next steps: Adverse Trace will monitor for proof-of-concept exploit code, CISA-KEV listing, and any confirmed in-the-wild exploitation. We will issue an updated advisory if CVSS scores are verified, if exploitation is observed, or if IOCs become available. Clients should patch to 19.1.1, 19.0.3, or 18.11.6 immediately and audit developer-role assignments and email account lists.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.