GitLab
GitLab Security Releases - September 2026
gitlab-2026-09 Sep 1, 2026 Source: Vendor
GitLab security advisories for September 2026: 23 CVEs, 17 credited researchers.
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
23 lines
Showing 1–23 of 23
CVE-2024-11222
BR2026-0000-032581
unclaimed
Race Condition issue in Merge Request Pipelines impacts GitLab CE/EE
Credited as xorz
CVE-2025-14871
BR2026-0000-032582
unclaimed
Denial of Service issue in GraphQL complexity limiter impacts GitLab CE/EE
Credited as hunter0xp7
CVE-2026-10518
BR2026-0000-032583
unclaimed
Improper Access Control issue in GraphQL memberRoles dependentSecurityPolicies resolver impacts GitLab EE
Credited as rogerace
CVE-2026-1168
BR2026-0000-032584
unclaimed
Denial of Service issue in GraphQL complexity limiter impacts GitLab CE/EE
Credited as joaxcar
CVE-2026-12910
BR2026-0000-032585
unclaimed
Improper Authentication issue in SAML SSO sign-in restriction enforcement impacts GitLab CE/EE
Credited as theluci
CVE-2026-13210
BR2026-0000-032586
unclaimed
Incorrect Authorization issue in CI/CD environment variable scope matcher impacts GitLab CE/EE
Credited as nwicks
CVE-2026-16794
BR2026-0000-032587
unclaimed
Missing Authorization issue in Compliance Framework management impacts GitLab EE
Credited as manual_mint
CVE-2026-19619
BR2026-0000-032588
unclaimed
Cross-site Scripting issue in Content Editor impacts GitLab CE/EE
Credited as lucvs
CVE-2026-3855
BR2026-0000-032589
unclaimed
Improper Input Validation issue in Terraform State API impacts GitLab CE/EE
Credited as ahacker1
CVE-2026-4523
BR2026-0000-032590
unclaimed
Missing Authorization issue in GraphQL CI job trace API impacts GitLab CE/EE
Credited as scyoon
CVE-2026-7514
BR2026-0000-032591
unclaimed
Missing Authorization issue in Generic Package Registry impacts GitLab CE/EE
Credited as toofikz
CVE-2026-78252
BR2026-0000-032592
unclaimed
Cross-site Scripting issue in Markdown JSON table renderer impacts GitLab CE/EE
Credited as a_m_a_m
CVE-2026-79708
BR2026-0000-032593
unclaimed
Scheduled Pipeline Execution Policy test allows Developers to access protected CI/CD variables
Credited as yvvdwf
CVE-2026-8030
BR2026-0000-032594
unclaimed
Improper Input Validation issue in Namespace Transfer impacts GitLab CE/EE
Credited as mateuszek
CVE-2026-82837
BR2026-0000-032595
unclaimed
Insufficiently Protected Credentials issue in Workhorse senddata emitters impacts GitLab CE/EE
Credited as 0xoroot
CVE-2026-84739
BR2026-0000-032596
unclaimed
Cross-site Scripting issue in merge request diff viewer impacts GitLab CE/EE
Credited as joaxcar
Path Traversal issue in repository commits API impacts GitLab CE/EE
Credited as s3ntago
CVE-2026-87719
BR2026-0000-032598
unclaimed
Insecure Deserialization issue in GraphQL subscription serializer impacts GitLab EE
Credited as kyyblin
CVE-2026-88765
BR2026-0000-032599
unclaimed
Buffer Overflow issue in Unicode conversion wrapper impacts GitLab EE
Credited as joaxcar
CVE-2026-89078
BR2026-0000-032600
unclaimed
Double Free issue in Regular Expression Parser impacts GitLab CE/EE
Credited as joaxcar
CVE-2026-8937
BR2026-0000-032601
unclaimed
Missing Authorization issue in Epic Issues REST API impacts GitLab CE/EE
Credited as rogerace
CVE-2026-92530
BR2026-0000-032602
unclaimed
Use of Less Trusted Source issue in Direct Transfer import user mapping impacts GitLab CE/EE
Credited as ahacker1
CVE-2026-93577
BR2026-0000-032603
unclaimed
Integer Overflow issue in Regular Expression Compiler impacts GitLab CE/EE
Credited as joaxcar