GitLab known exploited vulnerabilities
The Beam CVE database tracks 17 known exploited vulnerabilities for GitLab: 5 critical, 3 high, 5 medium and 4 low severity. 5 are known to be exploited (CISA KEV). The newest is CVE-2026-103515, published Oct 21, 2026.
These are the GitLab vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog: flaws with confirmed exploitation in the wild. Each entry links the vendor bulletin and CISA’s required action.
- Vulnerabilities tracked
- 17
- Critical
- 5
- Known exploited (CISA KEV)
- 5
- Published in the last 30 days
- 12
All entries, newest first
CVE-2026-103515
GitLab EE improper access control in group Duo admin-lock enforcement for Amazon Q settings
low2.7Oct 21, 2026CVE-2026-105711
GitLab CE/EE use of cache containing sensitive information in merge request title rendering
low3.5Oct 21, 2026CVE-2026-105777
GitLab CE/EE internal credential exposure in internal response headers
medium4.3Oct 21, 2026CVE-2026-110264
GitLab CE/EE integer overflow in regular expression compiler allows unauthenticated remote code execution
critical10.0Oct 21, 2026CVE-2026-112212
GitLab CE/EE cache poisoning in OAuth/OIDC discovery endpoints
high7.5Oct 21, 2026CVE-2026-112326
GitLab EE improper cleanup on thrown exception in security findings
low3.1Oct 21, 2026CVE-2026-112378
GitLab EE use of less trusted source in AI Gateway feature enablement header
medium4.3Oct 21, 2026CVE-2026-12664
GitLab CE/EE improper access control in GraphQL work item email address field
medium6.8Oct 21, 2026CVE-2026-13319
GitLab CE/EE authorization bypass through user-controlled key in group milestones API
medium4.3Oct 21, 2026CVE-2026-14288
GitLab EE improper access control in merge request approval policy enforcement
low3.1Oct 21, 2026CVE-2026-15723
GitLab CE/EE improper authentication in OmniAuth-to-LDAP auto-linking email lookup allows account takeover
high8.2Oct 21, 2026CVE-2026-16255
GitLab EE incomplete enforcement of instance-wide SAML/LDAP membership lock
medium5.9Oct 21, 2026CVE-2026-85706
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
critical10.0ExploitedSep 12, 2026CVE-2023-7028
GitLab Community and Enterprise Editions Improper Access Control Vulnerability
critical9.8ExploitedJan 12, 2024CVE-2021-39935
GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability
high7.5ExploitedDec 13, 2021CVE-2021-22175
GitLab Server-Side Request Forgery (SSRF) Vulnerability
critical9.8ExploitedJun 11, 2021CVE-2021-22205
GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
critical10.0ExploitedApr 23, 2021
