Vulnerabilities by vendor · updated on every deploy
GitLab vulnerabilities: exploited CVEs and our analysis
GitLab has 5 vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, 3 of them added in the last 12 months and 1 known to be used in ransomware campaigns. Below: the 4 analyses Zero Hunt Research published on GitLab products, then the catalog entries newest first with the federal due date.
CISA catalog version 2026.10.21, released 2026-10-21 14:04 UTC.
5
CVEs in CISA KEV
3
Added in the last 12 months
1
Known ransomware use
4
Zero Hunt analyses
Products with the most KEV entries: Community and Enterprise Editions (2) · Community Edition and Enterprise Edition (1) · GitLab (1) · GitLab CE/EE (1)
Our analysis of GitLab vulnerabilities
2026-10-22
GitLab CVE-2026-110264: CVSS 10 unauthenticated RCE through a rendered .org fileGitLab CVE-2026-110264 lets an unauthenticated attacker run code via a crafted Org-mode file. Fixed in 19.5.1, 19.4.3, 19.3.6; the October 12 patch is not enough.
2026-10-12
GitLab CVE-2026-97229: CVSS 10.0 unauthenticated RCE in the CI/CD regex compilerGitLab CE/EE ships a CVSS 10.0 unauthenticated RCE (CVE-2026-97229): a crafted CI/CD regex overflows into code execution. Patch 19.4.2/19.3.4/19.2.8 now.
2026-09-14
GitLab CVE-2026-85706: Unauthenticated File Read Empties Your CI/CD SecretsA CVSS 10 path-traversal in GitLab's commits API lets anyone read secrets.yml, deploy tokens and CI/CD variables — no login, no auth log. Patch, then rotate.
2026-08-19
GitLab CVE-2026-19478: An Unauthenticated GraphQL Directive Can Delete Your ReposGitLab's out-of-band patch fixes CVE-2026-19478 (CVSS 9.4): an unauthenticated GraphQL directive that can modify or delete public projects and user data. Who is affected, and how to fix it.
All 5 KEV entries
| Added | CVE | Product and vulnerability | Federal due date | Flags | Our analysis |
|---|---|---|---|---|---|
| 2026-09-11 | CVE-2026-85706 | Community Edition and Enterprise Edition GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforc… | 2026-09-14 | Forensic triage | Read → |
| 2026-02-18 | CVE-2021-22175 | GitLab GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled. | 2026-03-11 | — | |
| 2026-02-03 | CVE-2021-39935 | Community and Enterprise Editions GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API. | 2026-02-24 | — | |
| 2024-05-01 | CVE-2023-7028 | GitLab CE/EE GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an… | 2024-05-22 | — | |
| 2021-11-03 | CVE-2021-22205 | Community and Enterprise Editions GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which impro… | 2021-11-17 | Ransomware | — |
Source: CISA Known Exploited Vulnerabilities catalog (public data). Descriptions are CISA's, shortened. Always check the vendor advisory before acting. cisa.gov
Before you patch: three checks
- 01Match the exact version and configuration you run against the vendor advisory. Owning the product is not the same as being exposed.
- 02Check reachability: an exploited flaw on an interface reachable from the internet, or from a compromised workstation, moves to the front of the queue.
- 03Where CISA flags forensic triage, hunt for compromise as well as patch: a fix does not remove an attacker who got in before it.
Questions
How many GitLab vulnerabilities are in the CISA KEV catalog?
5 in catalog version 2026.10.21, the first added on 2021-11-03 and the most recent on 2026-09-11. 3 were added in the last 12 months.
Which GitLab products have the most exploited vulnerabilities?
By KEV entries: Community and Enterprise Editions (2), Community Edition and Enterprise Edition (1), GitLab (1), GitLab CE/EE (1).
Are GitLab vulnerabilities used in ransomware attacks?
CISA marks 1 of the 5 GitLab entries as known to be used in ransomware campaigns. The table flags them.
Is the next GitLab CVE exploitable on your network?
A KEV entry says a vulnerability is exploited somewhere. Zero Hunt answers whether it is exploitable in your environment: an autonomous AI red team on an on-premise appliance, running on private AI, black-box or gray-box, with a human approving every step that matters.
Other vendors: Cisco · Microsoft · Fortinet · Linux kernel · Citrix · Adobe · Palo Alto Networks · Check Point · Langflow · Arista · Oracle · SonicWall · Ivanti · VMware · Zimbra · SAP · Atlassian · Zyxel · Progress · F5