{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "GitLab heeft 12 kwetsbaarheden verholpen in GitLab Community Edition (CE) en Enterprise Edition (EE). Eén kwetsbaarheid is als kritiek aangemerkt.\n\n\nGitLab heeft een kwetsbaarheid verholpen in GitLab Community Edition en Enterprise Edition binnen de versies vanaf 7.0 tot bepaalde 19.x releases.", "title": "Feiten" }, { "category": "description", "text": "De kwetsbaarheid met kenmerk CVE-2026-110264 heeft een CVSS-score van 10,0 en betreft een integer overflow bij het compileren van een speciaal vervaardigde reguliere expressie. Onder bepaalde omstandigheden kan een niet-geauthenticeerde kwaadwillende de kwetsbaarheid op afstand misbruiken om willekeurige code op de GitLab-serveruit te voeren. De kwetsbaarheid treft GitLab-versies vanaf 7.0.\n\nDe kwetsbaarheden met kenmerk CVE-2026-15723 en CVE-2026-112212 zijn als High aangemerkt. CVE-2026-15723 kan door een geauthenticeerd aanvaller bij specifieke SAML- en LDAP-configuraties leiden tot overname van een bestaand account. CVE-2026-112212 betreft cache poisoning in OAuth/OIDC-discovery-endpoints en kan bepaalde authenticatiestromen omleiden naar een door een kwaadwillende beheerde server. De overige kwetsbaarheden kunnen onder meer leiden tot ongeautoriseerde toegang tot informatie en het omzeilen van toegangs- en beveiligingscontroles.\n\nGitLab heeft twee detectieregels gepubliceerd waarmee beheerders van self-managed GitLab-installaties kunnen zoeken naar mogelijke exploitatiepogingen van CVE-2026-110264. GitLab meldt vooralsnog geen actief misbruik van de kwetsbaarheid.", "title": "Interpretaties" }, { "category": "description", "text": "GitLab adviseert alle getroffen self-managed installaties zo snel mogelijk te upgraden naar een gepatchte versie. De kwetsbaarheden zijn verholpen in 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 en 19.5.1. GitLab.com is reeds bijgewerkt. GitLab Dedicated-installaties met versie 19.3.5-internal0, 19.4.2-internal0 of later bevatten de beveiligingsupdates al.\n\nVoor CVE-2026-110264 adviseert GitLab beheerders van self-managed installaties daarnaast de detectieregels “Onigmo native worker crash” en “Org mode render error burst” te gebruiken om te controleren op mogelijke exploitatiepogingen. Zie bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "general", "text": "Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')", "title": "CWE-90" }, { "category": "general", "text": "Insertion of Sensitive Information Into Sent Data", "title": "CWE-201" }, { "category": "general", "text": "Use of Less Trusted Source", "title": "CWE-348" }, { "category": "general", "text": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "title": "CWE-444" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference", "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/" } ], "title": "Kwetsbaarheden verholpen in GitLab door GitLab Inc.", "tracking": { "current_release_date": "2026-10-22T09:12:12.147880Z", "generator": { "date": "2025-08-04T16:30:00Z", "engine": { "name": "V.A.", "version": "1.3" } }, "id": "NCSC-2026-0447", "initial_release_date": "2026-10-22T09:12:12.147880Z", "revision_history": [ { "date": "2026-10-22T09:12:12.147880Z", "number": "1.0.0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-1" } } ], "category": "product_name", "name": "GitLab" } ], "category": "vendor", "name": "GitLab" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-12664", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "other", "text": "Incorrect Authorization", "title": "CWE-863" }, { "category": "description", "text": "GitLab versions prior to 19.3.6, 19.4.3, and 19.5.1 contained a vulnerability allowing authenticated users with read_api-scoped tokens to bypass token restrictions and access project incoming email addresses via a GraphQL field with insufficient scope enforcement.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-12664 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-12664.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "baseScore": 6.8, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-12664" }, { "cve": "CVE-2026-13319", "cwe": { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" }, "notes": [ { "category": "other", "text": "Authorization Bypass Through User-Controlled Key", "title": "CWE-639" }, { "category": "description", "text": "GitLab addressed a security vulnerability in certain GitLab CE/EE versions where authenticated users could access milestone metadata from private projects without proper authorization due to missing checks in the group milestones API.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-13319 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-13319.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-13319" }, { "cve": "CVE-2026-14288", "cwe": { "id": "CWE-706", "name": "Use of Incorrectly-Resolved Name or Reference" }, "notes": [ { "category": "other", "text": "Use of Incorrectly-Resolved Name or Reference", "title": "CWE-706" }, { "category": "description", "text": "GitLab addressed a security flaw in GitLab EE versions 17.4 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 that allowed authenticated users to bypass merge request approval policies on protected branches due to improper access control during approval rule synchronization.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-14288 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-14288.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 3.1, "baseSeverity": "LOW" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-14288" }, { "cve": "CVE-2026-15723", "cwe": { "id": "CWE-90", "name": "Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')", "title": "CWE-90" }, { "category": "description", "text": "GitLab addressed a security flaw in multiple versions where an authenticated user could hijack LDAP-backed accounts via improper input sanitization in LDAP email lookup during OmniAuth SAML and LDAP auto-linking.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-15723 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-15723.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "baseScore": 8.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-15723" }, { "cve": "CVE-2026-16255", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "other", "text": "Incorrect Authorization", "title": "CWE-863" }, { "category": "description", "text": "GitLab addressed a security flaw in GitLab EE versions prior to 19.3.6, 19.4.3, and 19.5.1 that allowed users to bypass instance-wide SAML or LDAP membership locks, enabling unauthorized project and group memberships outside identity provider controls.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-16255 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16255.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-16255" }, { "cve": "CVE-2026-103515", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "other", "text": "Incorrect Authorization", "title": "CWE-863" }, { "category": "description", "text": "GitLab addressed a security vulnerability in GitLab EE versions where group Owners could circumvent admin locks to reactivate AI-driven data egress to third-party services against administrator restrictions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103515 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103515.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "baseScore": 2.7, "baseSeverity": "LOW" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-103515" }, { "cve": "CVE-2026-105711", "cwe": { "id": "CWE-524", "name": "Use of Cache Containing Sensitive Information" }, "notes": [ { "category": "other", "text": "Use of Cache Containing Sensitive Information", "title": "CWE-524" }, { "category": "description", "text": "GitLab addressed a security flaw in versions 15.0 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 where authenticated users without project membership could view confidential issue titles from private projects via public merge requests due to improper caching.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-105711 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-105711.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "baseScore": 3.5, "baseSeverity": "LOW" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-105711" }, { "cve": "CVE-2026-105777", "cwe": { "id": "CWE-201", "name": "Insertion of Sensitive Information Into Sent Data" }, "notes": [ { "category": "other", "text": "Insertion of Sensitive Information Into Sent Data", "title": "CWE-201" }, { "category": "description", "text": "GitLab addressed a vulnerability in versions 17.6.5 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 where unauthenticated users could access sensitive internal server credentials due to improper filtering of internal response headers.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-105777 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-105777.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-105777" }, { "cve": "CVE-2026-110264", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "description", "text": "A vulnerability in GitLab CE/EE versions 7.0 through certain 19.x releases allows unauthenticated users to execute arbitrary code via an integer overflow triggered by a crafted regular expression.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-110264 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-110264.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10.0, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-110264" }, { "cve": "CVE-2026-112212", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')" }, "notes": [ { "category": "other", "text": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "title": "CWE-444" }, { "category": "description", "text": "GitLab versions 18.3 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 contained a vulnerability allowing unauthenticated users to manipulate OAuth/OIDC discovery documents via a shared cache, enabling redirection to external servers due to improper validation of cached endpoint URLs.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-112212 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-112212.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-112212" }, { "cve": "CVE-2026-112326", "cwe": { "id": "CWE-460", "name": "Improper Cleanup on Thrown Exception" }, "notes": [ { "category": "other", "text": "Improper Cleanup on Thrown Exception", "title": "CWE-460" }, { "category": "description", "text": "GitLab addressed a vulnerability in GitLab EE versions 17.8 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 that allowed authenticated users with read-only access to permanently delete existing vulnerability records due to improper error handling.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-112326 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-112326.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 3.1, "baseSeverity": "LOW" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-112326" }, { "cve": "CVE-2026-112378", "cwe": { "id": "CWE-348", "name": "Use of Less Trusted Source" }, "notes": [ { "category": "other", "text": "Use of Less Trusted Source", "title": "CWE-348" }, { "category": "description", "text": "GitLab addressed a vulnerability in GitLab EE versions 17.8 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 that allowed authenticated users to access paid AI features without valid subscription due to insufficient server-side billing validation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-112378 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-112378.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-112378" } ] }