GitLab Patches 12 Vulnerabilities, Including High-Severity WebSocket Flaw
Summary
GitLab released CE and EE updates fixing 12 vulnerabilities, including CVE-2026-5173, an authenticated WebSocket access-control bypass. Self-managed users should upgrade to 18.10.3, 18.9.5, or 18.8.9.
Key points
- CVE-2026-5173 affects specified GitLab CE/EE versions and could let an authenticated attacker bypass access controls and invoke unintended server-side methods.
- The fixes are in GitLab versions 18.10.3, 18.9.5, and 18.8.9; self-managed installations are urged to upgrade.
- GitLab says GitLab.com and GitLab Dedicated users are already protected.
- The update addresses 12 vulnerabilities, including denial-of-service flaws in the Terraform state lock API, GraphQL, CSV import, and the SBOM API.
- Other fixes address code injection, cross-site scripting, authorization issues, and information disclosure.
- The releases include no new migrations; multi-node deployments should not require downtime, though Omnibus upgrades may stop services by default.
Article Details
- Vulnerability Types
- WebSocket access-control bypass
- Denial of service
- Code injection
- Cross-site scripting
- Improper authorization or access control
- Information disclosure
- Severity
- High; CVE-2026-5173 has a CVSS score of 8.5.
- Affected Versions
- GitLab CE/EE 16.9.6 to versions before 18.8.9
- GitLab CE/EE 18.9 versions before 18.9.5
- GitLab CE/EE 18.10 versions before 18.10.3
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2025-12664GitLab · GitLabCVE-2025-12664: A DoS vulnerability in the GraphQL API that could be triggered through repeated queries (CVSS 7.5).CVE-2025-9484GitLab · GitLabCVE-2025-9484: Information disclosure via GraphQL queries (CVSS 4.3).CVE-2026-1092GitLab · GitLabCVE-2026-1092: A DoS issue in the Terraform state lock API caused by improper JSON validation (CVSS 7.5).CVE-2026-1101GitLab · GitLabCVE-2026-1101: A GraphQL SBOM API issue affecting GitLab EE, also enabling DoS attacks (CVSS 6.5).CVE-2026-1403GitLab · GitLabCVE-2026-1403: A CSV import flaw allowing authenticated users to disrupt Sidekiq workers (CVSS 6.5).CVE-2026-1516GitLab · GitLabCVE-2026-1516: A code injection issue in Code Quality reports that could expose user IP addresses (CVSS 5.7).CVE-2026-1752GitLab · GitLabCVE-2026-1752: Improper access control in the Environments API (CVSS 4.3).CVE-2026-2104GitLab · GitLabCVE-2026-2104: Information disclosure through CSV export (CVSS 4.3).CVE-2026-2619GitLab · GitLabCVE-2026-2619: Incorrect authorization in the vulnerability flags AI detection API (CVSS 4.3).CVE-2026-4332GitLab · GitLabCVE-2026-4332: A cross-site scripting vulnerability in analytics dashboards (CVSS 5.4).CVE-2026-4916GitLab · GitLabA low-severity issue, CVE-2026-4916, was also addressed, involving missing authorization checks in custom role permissions (CVSS 2.7).CVE-2026-5173GitLab · GitLabGitLab has released critical security patches for Community and Enterprise editions to fix twelve vulnerabilities, including a high-severity websocket flaw tracked as CVE-2026-5173.
People
a92847865Named as a researcher who contributed through GitLab's HackerOne bug bounty program; the article does not specify which vulnerability they reported.foxribeyeNamed as a researcher who contributed through GitLab's HackerOne bug bounty program; the article does not specify which vulnerability they reported.go7f0Named as a researcher who contributed through GitLab's HackerOne bug bounty program; the article does not specify which vulnerability they reported.maksycheNamed as a researcher who contributed through GitLab's HackerOne bug bounty program; the article does not specify which vulnerability they reported.sim4n6Named as a researcher who contributed through GitLab's HackerOne bug bounty program; the article does not specify which vulnerability they reported.Simon TomlinsonIdentified as a GitLab team member who discovered CVE-2026-5173 internally.
Vendors
Products
GitLab Community Edition (CE)It affects GitLab CE/EE versions from 16.9.6 prior to 18.8.9, version 18.9 before 18.9.5, and version 18.10 before 18.10.3.GitLab DedicatedPatched releases are 18.10.3, 18.9.5, and 18.8.9; GitLab.com and GitLab Dedicated users are already protected.GitLab EECVE-2026-1101: A GraphQL SBOM API issue affecting GitLab EE, also enabling DoS attacks (CVSS 6.5).GitLab.comPatched releases are 18.10.3, 18.9.5, and 18.8.9; GitLab.com and GitLab Dedicated users are already protected.