BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

GitLab

GitLab Security Releases - May 2026

gitlab-2026-05 May 1, 2026 Source: Vendor

GitLab security advisories for May 2026: 27 CVEs, 16 credited researchers.

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

27 lines
All 27 CVEs 27 Additional recognition 0 Unclaimed only
Showing 1–27 of 27
CVE-2025-12669 BR2026-0000-032045 unclaimed
Cross-site Scripting issue in achievement email notifications impacts GitLab CE/EE
Credited as ricardobrito
CVE-2025-13874 BR2026-0000-032046 unclaimed
Improper Access Control issue in issue links API impacts GitLab CE/EE
Credited as go7f0
CVE-2025-14869 BR2026-0000-032047 unclaimed
Denial of Service issue in internal API endpoints impacts GitLab CE/EE
Credited as a92847865
CVE-2025-14870 BR2026-0000-032048 unclaimed
Denial of Service issue in Duo Workflows API impacts GitLab CE/EE
Credited as a92847865
CVE-2026-1184 BR2026-0000-032049 unclaimed
Denial of Service issue in Insights Configuration impacts GitLab EE
Credited as a92847865
CVE-2026-1322 BR2026-0000-032050 unclaimed
Improper Authorization issue in GraphQL token scope enforcement impacts GitLab CE/EE
Credited as mateuszek
CVE-2026-1338 BR2026-0000-032051 unclaimed
Improper Access Control issue in Container Registry protected tags impacts GitLab CE/EE
Credited as go7f0
CVE-2026-1402 BR2026-0000-032052 unclaimed
Denial of Service issue in Wiki impacts GitLab CE/EE
Credited as a92847865
CVE-2026-1659 BR2026-0000-032053 unclaimed
Denial of Service issue in CI/CD job update API impacts GitLab CE/EE
Credited as a92847865
CVE-2026-2601 BR2026-0000-032054 unclaimed
Missing Authorization issue in Operations impacts GitLab EE
Credited as modhanami
CVE-2026-2710 BR2026-0000-032055 unclaimed
Incorrect Authorization issue in certain authentication endpoints impacts GitLab CE/EE
Credited as s4dmach1ne
CVE-2026-2900 BR2026-0000-032056 unclaimed
Access Control issue in GraphQL approval rule mutations impacts GitLab EE
Credited as modhanami
CVE-2026-3073 BR2026-0000-032057 unclaimed
Access Control issue in PyPI Package Protection Rules impacts GitLab CE/EE
Credited as modhanami
CVE-2026-3074 BR2026-0000-032058 unclaimed
Improper Access Control issue in NuGet Symbol Server impacts GitLab CE/EE
Credited as sndd
CVE-2026-3160 BR2026-0000-032059 unclaimed
Confused Deputy issue in Jira integration impacts GitLab CE/EE
Credited as maksyche
CVE-2026-3607 BR2026-0000-032060 unclaimed
Access Control issue in Helm package upload impacts GitLab CE/EE
Credited as aphantom
CVE-2026-4524 BR2026-0000-032061 unclaimed
Access Control issue in Issues API impacts GitLab CE/EE
Credited as hackaccinocraft
CVE-2026-4527 BR2026-0000-032062 unclaimed
CSRF issue in JiraConnect subscriptions impacts GitLab CE/EE
Credited as maksyche
CVE-2026-4868 BR2026-0000-032063 unclaimed
Improper Access Control issue in Duo AI workflow runners impacts GitLab EE
Credited as ahacker1
CVE-2026-5296 BR2026-0000-032064 unclaimed
Improper Authorization issue in Duo Workflows API impacts GitLab EE
Credited as rogerace
CVE-2026-6063 BR2026-0000-032065 unclaimed
Improper Access Control issue in code owner approval rules impacts GitLab EE
Credited as pollito
CVE-2026-6073 BR2026-0000-032066 unclaimed
Cross-site Scripting issue in Duo Agent output rendering impacts GitLab EE
Credited as joaxcar
CVE-2026-6335 BR2026-0000-032067 unclaimed
Cross-site Scripting issue in Banzai markdown sanitizer impacts GitLab CE/EE
Credited as toofikz
CVE-2026-6713 BR2026-0000-032068 unclaimed
Incorrect Authorization issue in GraphQL WorkItem API impacts GitLab CE/EE
Credited as pollito
CVE-2026-7377 BR2026-0000-032069 unclaimed
Cross-site Scripting issue in Analytics Dashboard impacts GitLab EE
Credited as aphantom
CVE-2026-7481 BR2026-0000-032070 unclaimed
Cross-site Scripting issue in Analytics dashboard chart rendering impacts GitLab EE
Credited as yvvdwf
CVE-2026-8280 BR2026-0000-032071 unclaimed
Denial of Service issue in direct transfer CSV parser impacts GitLab CE/EE
Credited as a92847865