GitLab
GitLab Security Releases - March 2026
gitlab-2026-03 Mar 1, 2026 Source: Vendor
GitLab security advisories for March 2026: 26 CVEs, 18 credited researchers.
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
27 lines
Showing 1–27 of 27
CVE-2025-12555
BR2026-0000-031997
unclaimed
Improper Access Control issue in runners API impacts GitLab CE/EE
Credited as iamgk808
CVE-2025-12576
BR2026-0000-031998
unclaimed
Denial of Service issue in webhook endpoint impacts GitLab CE/EE
Credited as sim4n6
CVE-2025-12697
BR2026-0000-031999
unclaimed
Improper Escaping of Output issue in Datadog integration impacts GitLab CE/EE
Credited as shells3c
CVE-2025-12704
BR2026-0000-032000
unclaimed
Incorrect Authorization issue in Virtual Registry impacts GitLab EE
Credited as mateuszek
CVE-2025-13078
BR2026-0000-032001
unclaimed
Denial of Service issue in webhook configuration impacts GitLab CE/EE
Credited as lucky_luke
CVE-2025-13436
BR2026-0000-032002
unclaimed
Denial of Service issue in CI configuration processing impacts GitLab CE/EE
Credited as a92847865
CVE-2025-13690
BR2026-0000-032003
unclaimed
Denial of Service issue in webhook custom headers impacts GitLab CE/EE
Credited as sim4n6
CVE-2025-13929
BR2026-0000-032004
unclaimed
Denial of Service issue in repository archive endpoint impacts GitLab CE/EE
Credited as joaxcar
CVE-2025-14513
BR2026-0000-032005
unclaimed
Denial of Service issue in protected branches API impacts GitLab CE/EE
Credited as a92847865
CVE-2025-14595
BR2026-0000-032006
unclaimed
Access Control issue in GraphQL API impacts GitLab EE
Credited as kamikaze1337
CVE-2026-0602
BR2026-0000-032007
unclaimed
Improper Access Control issue in snippet rendering impacts GitLab CE/EE
Credited as go7f0
CVE-2026-1069
BR2026-0000-032008
unclaimed
Denial of Service issue in GraphQL API impacts GitLab CE/EE
Credited as a92847865
CVE-2026-1090
BR2026-0000-032009
unclaimed
Cross-site Scripting issue in Markdown placeholder processing impacts GitLab CE/EE
Credited as yvvdwf
CVE-2026-1182
BR2026-0000-032010
unclaimed
Information Disclosure issue in confidential issues impacts GitLab CE/EE
Credited as yvvdwf
CVE-2026-1230
BR2026-0000-032011
unclaimed
Incorrect Reference issue in repository download impacts GitLab CE/EE
Credited as st4nly0n
CVE-2026-1663
BR2026-0000-032012
unclaimed
Missing Authorization issue in Group Import impacts GitLab CE/EE
Credited as go7f0
CVE-2026-1724
BR2026-0000-032013
unclaimed
Improper Access Control issue in GraphQL query impacts GitLab EE
Credited as maksyche
CVE-2026-1732
BR2026-0000-032014
unclaimed
Information Disclosure issue in inaccessible issues impacts GitLab CE/EE
Credited as modhanami
CVE-2026-2370
BR2026-0000-032015
unclaimed
Improper Handling of Parameters issue in Jira Connect installations impacts GitLab CE/EE
Credited as maksyche
CVE-2026-2726
BR2026-0000-032016
unclaimed
Improper Access Control issue in Merge Requests impacts GitLab CE/EE
Credited as pkkr
CVE-2026-2745
BR2026-0000-032017
unclaimed
Improper Access Control issue in WebAuthn 2FA impacts GitLab CE/EE
Credited as a0xnirudh
CVE-2026-2973
BR2026-0000-032018
unclaimed
Cross-site Scripting issue in Mermaid diagram renderer impacts GitLab CE/EE
Credited as go7f0
CVE-2026-2995
BR2026-0000-032019
unclaimed
HTML Injection in vulnerability report impacts GitLab EE
Credited as a_m_a_m
CVE-2026-2995
BR2026-0000-032020
unclaimed
HTML Injection in vulnerability report impacts GitLab EE
Credited as yvvdwf
CVE-2026-3848
BR2026-0000-032021
unclaimed
Improper Neutralization of CRLF Sequences issue impacts GitLab CE/EE
Credited as shells3c
CVE-2026-3857
BR2026-0000-032022
unclaimed
Cross-Site Request Forgery issue in GLQL API impacts GitLab CE/EE
Credited as ahacker1
CVE-2026-3988
BR2026-0000-032023
unclaimed
Denial of Service issue in GraphQL API impacts GitLab CE/EE
Credited as svalkanov