Skip to content

GitLab Inc. - HackerOne Bounty Program

Company Profile

GitLab Inc. is an American multinational software company that develops and maintains a web-based DevOps lifecycle tool providing Git repository management, issue tracking, continuous integration/continuous deployment (CI/CD), and software development collaboration features.

Wikipedia: https://en.wikipedia.org/wiki/GitLab

Corporate Overview:

  • Founded: 2011 by Dmitriy Zaporozhets and Valery Sizov (Ukraine)
  • Incorporated: 2014 in Delaware, USA by Sid Sijbrandij
  • Headquarters: San Francisco, California, USA
  • Employees: ~2,000+ worldwide (2024)
  • CEO: Sid Sijbrandij (Co-founder)
  • Public Company: NASDAQ: GTLB (IPO: October 2021)

Financial Profile (2024):

  • Market Cap: ~$8 billion USD
  • Annual Revenue: ~$650 million USD (2024)
  • Subscription Model: Freemium SaaS with enterprise tiers
  • Customer Base: 30+ million registered users
  • Enterprise Customers: 50,000+ organizations

Business Evolution & Key Milestones:

  • 2011: Created as open-source Git repository management
  • 2013: GitLab.com SaaS platform launched
  • 2014: Company incorporated, raised Series A ($1.5M)
  • 2015-2020: Rapid feature expansion, DevOps platform evolution
  • 2021: Public IPO on NASDAQ
  • 2022-2025: AI/ML integration, competitive positioning vs GitHub

Key Products & Services:

  • GitLab SaaS: Cloud-hosted DevOps platform
  • GitLab Self-Managed: On-premises/private cloud deployment
  • GitLab.com: Free public repository hosting
  • CI/CD Pipelines: Integrated continuous integration/deployment
  • Security & Compliance: SAST, DAST, dependency scanning
  • Issue Tracking: Project management and collaboration tools

Competitive Landscape:

  • Primary Competitor: Microsoft GitHub (acquired 2018, $7.5B)
  • Differentiation: All-in-one DevOps platform vs GitHub's ecosystem approach
  • Market Position: #2 in Git-based source code management
  • Enterprise Focus: Strong presence in regulated industries

HackerOne Bug Bounty Program

Program URL: https://hackerone.com/gitlab
Primary Domain: gitlab.com
Last Updated: 2025-09-01
Risk Level: 🟡 MEDIUM

Program Overview

GitLab operates a well-established bug bounty program for their DevOps platform. As a security-focused development tool company, GitLab maintains sophisticated security practices and demonstrates consistent engagement with researchers through smaller but regular bounty awards.

Historical Activity (6-month window)

  • Total Payouts: $600.00 (Rank #6)
  • Reports Resolved: 12
  • Average Per Report: $50.00
  • Activity Pattern: Consistent monthly activity with smaller individual awards
  • Focus Areas: DevOps pipeline security, source code management, CI/CD

Attack Surface Analysis (2025-09-01)

Discovered Infrastructure

  • Subdomains Identified: 8 active subdomains
  • Live Web Services: 12 responsive endpoints
  • Security Posture: Well-hardened with professional security practices

Key Subdomains

Subdomain Purpose Security Notes
www.gitlab.com Main Platform Primary GitLab application
api.gitlab.com API Gateway Well-protected API endpoints
docs.gitlab.com Documentation Technical documentation
help.gitlab.com Support Help and support resources

Security Analysis

  • Professional Hardening: Fewer obvious misconfigurations detected
  • Standard Patterns: Typical enterprise subdomain structure
  • Defensive Posture: Evidence of mature security practices
  • Limited Exposure: Minimal obvious attack surface

Notable Characteristics

  • DevOps Focus: Security-oriented development platform
  • Enterprise Grade: Professional security implementation
  • Research Friendly: Active engagement with security community
  • Continuous Improvement: Regular updates and security enhancements

Scope Snapshot (as of 2025-09-01)

See scope.md for full policy text and breakdown.

Key Focus Areas

  • GitLab.com hosted service security
  • Self-hosted GitLab instance vulnerabilities
  • CI/CD pipeline security
  • Source code management features
  • Container registry security

Research Priorities

Phase 1 - DevOps Pipeline Security

  • CI/CD pipeline injection vulnerabilities
  • Repository access control bypass
  • Docker registry security assessment
  • Secrets management analysis

Phase 2 - Application Security

  • Source code management vulnerabilities
  • Issue tracking and project management
  • User permission and role escalation
  • Integration security (webhooks, APIs)

Phase 3 - Infrastructure Security

  • Self-hosted instance security
  • Container security and isolation
  • Network security and access controls
  • Data protection and encryption

Notes & Intelligence

  • Bounty policy update (published 2026-01-20): GitLab formalized testing guidance and scope boundaries — strongly recommends local GDK testing; production testing on GitLab.com requires test accounts created with the researcher's HackerOne email alias. Application-layer DoS is now out of scope except persistent total disruption via unauthenticated endpoints (ReDoS/logic-bomb exceptions considered). Standalone prompt injection is out of scope, but may be eligible when it serves as an initial vector achieving harm beyond its own security boundary. Enumeration-only findings remain out of scope; privacy breaches exposing confidential data are in scope. Practical read: Duo/AI-finding reports must demonstrate downstream harm (data/credential exposure), not prompt-injection alone; DoS-shaped GraphQL complexity findings likely ineligible. Source: https://about.gitlab.com/blog/gitlab-bug-bounty-program-policy-updates/

  • Security-First Culture: Company culture emphasizes security best practices

  • Transparent Development: Open-source approach to security improvements
  • Community Engagement: Active participation in security research community
  • Regular Updates: Frequent security patches and feature updates

Recent Public Security Advisories

  • 2026-10-22 — 19.5.1-wave GHSA mirrors landed in the GitHub advisory feed (unreviewed tier, published 2026-10-22T03:33Z); five previously nameless fixes get locked names + mechanics. Sweep-47 (CUT 2026-10-21T20:39Z) caught 12 GitLab GHSAs, the expected next-hours GHSA mirror of the docs-page patch wave recorded yesterday — no new vulnerabilities, but three low-tier entries previously summarized generically are now fully described: CVE-2026-105711 (3.5, GHSA-5jh8-pw64-jw5v) — a viewer-independent fragment cache key leaks a private project's confidential-issue title to an authenticated non-member when a public-project MR references it (cross-boundary cache-key class: cache keys that omit viewer identity across an authz boundary — sweep this pattern on any program with cross-project references + fragment caching); CVE-2026-112378 (4.3, GHSA-38rf-7hwj-5rg8) — authenticated access to paid AI features without a valid subscription (client-trusted billing-eligibility checks; monetization-authz is a distinct probe lane); CVE-2026-112326 (3.1, GHSA-h7pg-g89w-v3vj) — read-only role permanently deletes vulnerability records (cleanup logic failing to distinguish pre-existing vs newly created findings — destructive-action-on-read-only-role is a severity-narrative gift if reproduced on scope); CVE-2026-14288 (3.1, GHSA-xxf3-q32p-w3cc) — required MR approval-policy bypass on protected branches via approval-rule synchronization desync; CVE-2026-103515 (2.7, GHSA-x828-vfgm-5mgh) is the entry the 10-21 note carried as "CVE-2026-1035xx": group Owner can re-enable Duo AI data egress to Amazon Q after admin locks the group's Duo availability. All 12 GHSA↔CVE pairings verified against live advisory API 2026-10-22; full band table for CVE-2026-110264 confirmed identical to docs page (7.0→18.11.13/19.0.10/19.1.9/19.2.9/19.3.6/19.4.3/19.5.1). EE-only vs CE split now visible in mirrors: 14288/112378/112326/103515/16255 are EE-only; the rest CE+EE. Sources: https://github.com/advisories/GHSA-5jh8-pw64-jw5v , https://github.com/advisories/GHSA-38rf-7hwj-5rg8 , https://github.com/advisories/GHSA-h7pg-g89w-v3vj , https://github.com/advisories/GHSA-xxf3-q32p-w3cc , https://github.com/advisories/GHSA-x828-vfgm-5mgh
  • 2026-10-21 — GitLab CRITICAL patch release 19.5.1 / 19.4.3 / 19.3.6 + emergency backports 19.2.9 / 19.1.9 / 19.0.10 / 18.11.13 — the fold-wave advisories have landed, and the regex-compiler saga escalates. Verified 2026-10-21 via gitlab.com repository-tags API (v19.5.1-ee committed 2026-10-20T23:04Z, v19.4.3-ee 23:11Z, v19.3.6-ee 23:20Z; v19.2.9-ee 17:21Z, v18.11.13-ee 17:36Z) and the GitLab docs patch page; note git ls-remote to gitlab.com was intermittently load-shedding ("GitLab is currently unable to handle this request") — the REST tags API (/api/v4/projects/gitlab-org%2Fgitlab/repository/tags?search=) is the durable fallback. Headliners:
  • CVE-2026-110264 (CVSS 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, Critical) — Integer Overflow in the Regular Expression Compiler → unauthenticated arbitrary code execution. Affected: ALL GitLab CE/EE versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, 19.5 before 19.5.1 — a ~12-year exposure window, and notably the 19.2 line (declared EOL 2026-10-15, see entry below) received an out-of-band backport precisely because this was too severe to leave frozen-unfixed. Same component lineage as CVE-2026-97229 (the Oct-12 unauth regex RCE, PR:N-corrected-by-Rapid7 to require a committed .gitlab-ci.yml) and the Sept authenticated 9.9 regex RCEs — GitLab's own detection guidance ships two threat detections: Onigmo native worker crash and org mode render error burst, implying the exploitation primitive touches Onigmo compilation AND the org-mode render path (a second sink family beyond CI configs — org-mode markup is rendered from repository files/issues, a much lower-friction input than needing repo write access). Hunting read: the regex/compiler attack surface on this program is now confirmed across ≥4 CVEs in 8 weeks and two input planes (CI config regex, org-mode markup). Patch-level fingerprinting just got a hard reset: banner <18.11.13 / <19.0.10 / <19.1.9 / <19.2.9 / <19.3.6 / <19.4.3 / <19.5.1 is a standing unauth-RCE indicator on self-managed; every prior banner-fitness rule in the entries below (19.3.4 unpatched, 19.2.8-frozen) is superseded. Do NOT test the compiler sink against shared/production instances — crash fuzzing an Onigmo overflow is destructive; owned instances only. GitLab.com already patched; Dedicated tenants on 19.3.5-internal0 / 19.4.2-internal0+ unaffected. KEV-watch this immediately given the CVE-2026-85706 precedent (KEV'd within a day).
  • CVE-2026-15723 (8.2, High) — OmniAuth-to-LDAP auto-linking email lookup improper authentication → account takeover of LDAP-backed accounts, no victim interaction, when OmniAuth SAML + LDAP auto-linking are both enabled (≥10.1, fixed 19.3.6/19.4.3/19.5.1). Identity-federation auto-linking remains this program's richest ATO lane — the GhostPat entry below (identity transition re-pointing live credentials) and this (email-claim auto-link with unsanitized lookup) are the same axis: the linking key is an attacker-influenceable email and the link is made without proof of possession. Enterprise/self-managed GitLab with SAML+LDAP is the target profile; on GitLab.com, check whether the SAML auto-link config surface is admin-reachable in-scope.
  • CVE-2026-112212 (7.5, High) — unauth cache poisoning of OAuth/OIDC discovery documents via user-supplied values in constructed endpoint URLs, redirecting flows to attacker servers (≥18.3). Discovered internally (Peter Arts). Hunting read: Host/X-Forwarded-Host-derived URL construction inside cached responses is the class — probe any endpoint that echoes request-derived base URLs into JSON documents behind a CDN/shared cache, including .well-known/ variants on target programs beyond GitLab.
  • CVE-2026-12664 (6.8) — GraphQL work-item email-address field: read_api-scoped token retrieves a project's incoming email address and creates work items, bypassing token scope — resolver-level scope-enforcement again (standing "GraphQL is its own authz plane" lane; the 19.5.0 fold's security!6517/6654 family gets a named CVE). CVE-2026-16255 (5.9, EE) — instance-wide SAML/LDAP membership lock not enforced on membership requests created before the lock was enabled — stale-precedence state class, same lifecycle-transition axis as CVE-2026-81839. CVE-2026-105777 (4.3) — unauthenticated retrieval of internal server credentials via unfiltered internal response headers. CVE-2026-13319 (4.3) — group milestones API missing authz on user-supplied project filter → cross-instance private-project milestone metadata read without membership (IDOR-on-filter-parameter class). Low tier: MR-title render cache leak, MR approval-policy enforcement, security-findings exception-cleanup, and CVE-2026-1035xx group Duo admin-lock bypass allowing re-enable of AI data egress to Amazon Q despite admin lock (AI-egress governance bypass; pairs with the Duo token-governance family). Backport-workhorse note also strips the trusted flag from client-supplied MCP tools — second consecutive MCP-tool-trust fix wave.
  • Fold accounting: this release enumerates the 2026-10-16/17 19.5.0 "security-tagged commits without advisories" prediction — advisory-watch for that fold can close; issues go public on GitLab's tracker 90 days post-release (~late January 2027) for mechanics detail. Sources: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/ , gitlab.com repository-tags API (verified 2026-10-21), hub.docker.com gitlab/gitlab-ee tags (19.5.1-ee.0/19.4.3-ee.0/19.3.6-ee.0 published within the last hours).
  • 2026-10-16 — GitLab 19.2 line reached End of Support on 2026-10-15. 19.2.8 (the CVE-2026-97229 fix) is the final release the 19.2 line will ever receive — new vulnerabilities discovered on 19.2.x will go unfixed, only the 19.3/19.4 lines continue receiving security patches. Hunting read: for bug-bounty relevance this matters on self-managed targets in two ways — (a) a 19.2.8 banner is now a "frozen, will-never-be-patched" fingerprint rather than "current", so any future 19.2-only regression/0-day has guaranteed no-fix permanence and stronger severity narratives; (b) for the CVE-2026-84284 fingerprinting gotcha above (19.3 line has no fixed release), the only durable closes are 19.4.2+ or the frozen 19.2.8 — instances pinned to 19.3.x are simultaneously vulnerable to the unauth GraphQL work-item disclosure AND approaching their own EOL on 2026-11-19. Combined with the CVE-2026-97229 exploit-class attention and third-party scanning now sweeping unpatched instances, the patch-level distribution of internet-facing GitLab is actively shifting — re-scan banners before relying on any <19.4.2 finding. Source: https://about.gitlab.com/maintenance/ (release-maintenance schedule; corroborated by eol-trackers 2026-10-16).
  • 2026-10-16 — GitLab 19.5.0 shipped with 11 security-tagged fixes folded into the feature release (correction to the "no security table" note below). Verified 2026-10-16 against the live master CHANGELOG.md: every entry below carries Changelog: security in its commit message and merges from gitlab-org/security/gitlab MRs, yet none had a published GHSA/CVE at check time — classic GitLab fold pattern: security fixes land in the feature release, advisories/CVEs follow with the next patch batch (expect 19.2.9/19.3.6/19.4.3/19.5.1 to enumerate them). Advisory-watch: these eleven become named CVEs within ~2 weeks; banner <19.5.0 on self-managed is already a vulnerability indicator for this set. The fixes cluster into three hunt axes that confirm standing lanes:
  • Fine-grained PAT boundary family (3 fixes) — granular-token enforcement added on project label edits (security!6688), on import target namespaces (security!6689), and against resolved integration + work-item parent for integrations (security!6690). Third wave confirming the PAT scope-drift axis: each fix is "the boundary was checked against the request context, not the resolved target object." Sweep rule unchanged: for every token-gated write, ask what object the authz check actually resolves — the URL resource or the effective side-effect target.
  • AI/Duo token + context family (3 fixes) — note bodies now escaped in ConversationContextBuilder and the mention/flow-handler path (security!6604; same instruction-injection surface class as CVE-2026-96893), Duo Workflow tool governance resolved from the executed workflow with the service token bound to it (security!6492), and direct_access stopped issuing Duo Workflow Service tokens at all (security!6854). Pattern: service tokens were being minted broader than the action justified — token-minting-permission audit on every AI service path is the probe.
  • Work-item/Epic disclosure + SSRF breadth (4 fixes) — external authorization bypass leaking legacy epic content via GraphQL group.workItem (security!6654), private child items hidden in the Epic API (security!6475), GraphQL MemberRole.dependentSecurityPolicies resolver missing a per-policy read-authz filter (security!6517), and DNS-rebinding SSRF fixed "across all import features" — wiki pipeline, repository pipeline, snippets importer, GitLab/GitHub/LegacyGitHub importers all patched in one MR (security!5994), the same resolve-twice class as CVE-2026-100104 but showing the guard was absent from most importers, not just one. Fifth confirmation the GraphQL resolver layer is its own authz plane (item-level authz ≠ resolver-level authz).
  • Minor: alert webhook token comparison moved to constant-time secure_compare (timing-oracle hygiene class — worth probing any product comparing webhook secrets with ==). Sources: https://gitlab.com/gitlab-org/gitlab/-/raw/master/CHANGELOG.md (19.5.0 section, 2026-10-15), commit patches spot-verified 2026-10-16.
  • 2026-10-17 — Correction to the entry above: the 19.5.0 Security table holds 45 changes, not 11. Re-fetched master CHANGELOG.md live 2026-10-17 (file hash unchanged since the 10-16 check, so this is the same table misread, not a changelog update): the 11 we inventoried were the subset carrying MR links — the remaining ~34 security-tagged commits merge from gitlab-org/security without MR references, which is why the first pass undercounted them. A few entries are dependency/version bumps (gitaly, sidekiq-cron 2.4.0, Elasticsearch Indexer 5.14.14, GITLAB_PAGES_VERSION) rather than first-party fixes. New hunt-relevant families beyond the three already logged (advisory-watch still open — GHSA advisory search over the newest 300 published advisories found zero GitLab entries as of 2026-10-17):
  • Cascading auth skip family (3 fixes) — authorization checks skipped on nested collection widgets: work item hierarchy, merge request discussions, work item notes-widget discussions. Sixth confirmation of the GraphQL/nested-widget authz-plane axis, new mechanism flavor: parent authz passes, child-collection rendering skips its own check — probe every parent→child collection endpoint at the lowest role even when the parent read is legitimately allowed.
  • Build-trace authorization family (3 fixes) — read_build_trace enforced on Duo job-trace paths, on GraphQL CiJob.trace, and separately on accessibility/codequality report artifacts by viewer (not token). CI trace content keeps recurring as a leak path (see CVE-2026-92470); any AI/agent feature or artifact type that reads traces is an authz-parity test against the raw REST/GraphQL equivalent.
  • Regex-compiler hardening pair (2 fixes) — "Bound compiled size of CI rules regexp patterns" + "Guard regexp compilation in CI rules clauses" shipped alongside the CVE-2026-97229 era in the same component: confirm the compiler is being hardened at the program-size calculation site; banners on 19.5.0 can be assumed post-hardening, pre-19.5.0 pre-hardening.
  • Transfer-lifecycle stale state — "Delete orphaned pipeline execution schedules on project transfer" is the fix mechanism for the CVE-2026-81839 class: stale scheduled-pipeline records surviving transfer. Sweep rule sharpened: on transfer/rename/merge handlers, enumerate DB tables whose rows cache authorization or scheduling state and check cleanup coverage per-table.
  • Smaller durable classes: commit authors prevented from approving their own MRs (approval-bypass integrity), MR header URLs built without the request Host header (Host-header injection class), traversal segments rejected in diff file URLs (path traversal in diff viewer), raw ref SHA match anchored to string start (ref-validated-by-prefix class), package protection enforced on npm dist-tag delete + disabled package registry honored through the API (supply-chain integrity: dist-tag movement is a package-attack primitive independent of version immutability), admin compliance-pipeline config removed from custom roles, API keys filtered from LLM logs (secret-echo in AI telemetry — probe every Duo/agent log path for material it shouldn't persist), workplan resume tokens bound to foundational flow ID + mcp scope auth restricted to mcp-route-setting routes (token-binding class, same axis as the Duo service-token fixes). Sources: https://gitlab.com/gitlab-org/gitlab/-/raw/master/CHANGELOG.md (19.5.0 "Security (45 changes)" section), live re-verification 2026-10-17.

  • 2026-10-15 — GitLab 19.5 feature release: MCP server rate limits + ECA governance surface. Two hunting-relevant deltas from the 19.5 release (NOTE: the "no security table" assumption was wrong — see 2026-10-16 entry above; 11 security-tagged commits shipped inside 19.5.0): (1) Starting Oct 15, the GitLab.com MCP server enforces per-user rate limits — 60 req/min Free tier, 600 req/min Premium/Ultimate; every reconnect and retry counts toward the limit (HTTP 429 on breach). Directly relevant to the standing MCP-API probe lane (CVE-2026-92874/92628 wave): pacing on MCP endpoints is now enforced server-side, and retry storms burn quota — calibrate scope/token-boundary probes against the tier limit and treat 429 behavior itself as a probe (does throttling state leak across tokens/scopes?). (2) 19.5 extends AI Governance to Externally Connected Agents (ECAs) — Claude Code, Cursor, Codex connectable to governance visibility via glab govern setup when "Allow external agents" + "Store AI audit events" are enabled. New config/audit surface: ECA registration, audit-event storage, and the governance boundary between externally-run agents and instance policy. AI Gateway also gains per-model AWS IAM role assumption (cross-account role config = new authz review point). Sources: https://docs.gitlab.com/releases/19/gitlab-19-5-released/

  • 2026-10-12/13 — Third max-severity patch batch in six weeks (19.2.8 / 19.3.5 / 19.4.2; ~24 fixed issues): unauthenticated RCE in the CI/CD regex compiler. CVE-2026-97229 (CVSS 10.0, CWE-190, GHSA-9hj5-r43h-h3xg) — integer overflow in the CI/Regular Expression Compiler that parses/evaluates regexes in project pipeline configuration files; a specially crafted regex in a CI/CD config yields unauthenticated arbitrary code execution on the server ("under certain conditions"; SSVC: Automatable: yes, Technical Impact: total, Exploitation: none as of 2026-10-14). Reported via HackerOne by joaxcar (reports 4055749/4058589). Affected: ≥19.2 <19.2.8, ≥19.3 <19.3.5 (CERT-EU cites 19.3.4 — GitHub advisory band says 19.3.5; treat both as unpatched until 19.3.5), ≥19.4 <19.4.2. No KEV entry as of 2026-10-14 — KEV-watch. Hunting read: third consecutive unauthenticated max-severity compiler/parser sink on this program in six weeks (Sept CVE-2026-85706 repository-commits path confinement 10.0 KEV'd → Sept CVE-2026-93577/89078 authenticated regex-compiler RCEs 9.9 → now Oct CVE-2026-97229 the same regex-compiler sink crossed to unauth). The regex validator/evaluator itself is confirmed parser attack surface à la Spring4Shell: on any product that gates config/YAML fields "by regex," the regex evaluation at the gate is the test target. GitLab.com is patched server-side; on self-managed banners <19.2.8/<19.3.5/<19.4.2, CI-config regex evaluation is a checked primitive in authorized labs only (timing-based ReDoS probes on owned instances, never crash fuzzing against shared instances). Sources: https://github.com/advisories/GHSA-9hj5-r43h-h3xg , https://nvd.nist.gov/vuln/detail/CVE-2026-97229 , https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released , https://cert.europa.eu/publications/security-advisories/2026-016/ , BleepingComputer 2026-10-13.

  • 2026-10-13 follow-up (Rapid7 ETR, reproduced): Rapid7 independently reproduced arbitrary code execution on an unpatched official CE 19.4.1 image (same input fails on patched 19.4.2); no confirmed in-the-wild exploitation as of writing. Prerequisite correction to the vendor's PR:N claim: the attacker must first commit a malicious .gitlab-ci.yml plus a repo path containing UTF-8 characters to a branch of a public project — trivially satisfied on self-managed instances with open signup/public-project creation. Mechanism: crafted regex compiles as US-ASCII and passes validation, then Onigmo recompiles for UTF-8 encoding after the checks; integer overflow in the compiler's program-size calculation yields invalid regex instructions → control-flow loss → attacker-controlled Onigmo VM ops → OS command as the git user in the Rails/worker process. Durable hunting read: post-validation re-compilation under a different encoding is the bypass class — any validator that inspects a regex/pattern in one canonical form, then lets the engine re-derive it under another (encoding, collation, normalization), has a TOCTOU gap worth probing on every pattern-gating feature. Also confirmed: 19.3.4 was superseded by 19.3.5 (19.3.4 broke MR pages with the Ona integration) — fingerprinting banners must treat 19.3.4 as unpatched. Same batch adds CVE-2026-92883 (8.7 stored XSS via syntax highlighting in crafted repository) and CVE-2026-16301 (8.5 Developer-role downstream-pipeline execution on protected branches — deploy-credential boundary; already inventoried). Patch carries DB migrations; single-node instances are down during upgrade. Source: https://rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab/
  • Same batch — new named hunt axes (from unreviewed advisory tier, verified against live advisories 2026-10-14):
    • GHSA-5vgp-j37h-7wfx / CVE-2026-96893 (High, EE): authenticated user injects crafted content into AI agent instructions → command execution attributed to other users (improper neutralization of special elements in AI conversation context construction). Attribution-confusion is a distinct impact class from plain tool execution — this is the fourth consecutive wave where Duo/AI surfaces were the privileged path (trace reads CVE-2026-92470 → GraphQL subscription deserialization CVE-2026-87719 → gateway template escape CVE-2026-90970 → instruction-injection attribution confusion CVE-2026-96893). Probe battery: every field entering agent instruction/context construction (issue/MR descriptions, commit messages, branch names, review comments) with inert marker tools, proving both execution and whose identity the execution is logged under.
    • GHSA-49c6-8ph4-9vr9 / CVE-2026-14814 (High): cache-key poisoning of raw repository files via improper repository-reference validation → other users' CI/CD pipelines execute crafted content → protected environment-variable exposure. Sweep rule: any raw-file endpoint whose cache key includes a caller-supplied ref/sha/specifier.
    • GHSA-mv9g-3c33-88m6 / CVE-2026-100104: SSRF via TOCTOU in URL validation during repository import (validator resolves once, fetcher resolves again — DNS-rebind class). GitLab import is now a named anchor for URL-guard testing; owned-redirector/canary validation only.
    • CVE-2026-84284 (5.3, GHSA-3g57-f338-642q): unauthenticated read of work-item contents from private groups/projects via incorrect authorization checks in GraphQL work item hierarchy. Affected: 17.11 <19.2.8, all 19.3 versions, 19.4 <19.4.2. Fingerprinting gotcha: the 19.3 line has NO fixed release — 19.3.5 still vulnerable; only 19.2.8 or 19.4.2 close it. Banner <19.4.2 on the 19.3 line is a standing unauth-disclosure indicator, not a patched-but-older read. Second confirmation of the GraphQL-is-its-own-authz-plane axis (hierarchy resolvers leak across the membership boundary even when item-level authz holds — test child→parent and sibling traversal at lowest role). Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-84284 , https://github.com/advisories/GHSA-3g57-f338-642q , https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
    • CVE-2026-81839 (7.7, EE only): incorrect authorization letting a user run pipelines in a transferred project with the new group's privileges because old scheduled-pipeline execution policy records weren't cleaned up on transfer (folded inventoried the mechanics without the CVE; now named). Lifecycle-transition stale-policy class: project/group transfer, rename, and merge handlers that cache authorization state are the sweep targets. Source: SANS NewsBites XXVIII-76 (2026-10-13), GitLab 19.4.2 advisory.
    • Folded inventory on this wave: fine-grained-PAT scope-drift family (import into out-of-scope namespaces, group integrations from project-scoped tokens, package-protection bypass), unauth GraphQL disclosure legs (work items; confidential/internal notes on public projects — GraphQL is its own authz plane: test every query type at the lowest role), Developer-triggered downstream pipelines on protected branches, stale scheduled-pipeline records surviving project transfer, Kubernetes-agent proxy redirect stealing auth tokens, Pages log token leaks, Duo agent-platform token governance bypass via untrusted input, Pages cache-key poisoning, MR self-approval identity-resolution drift, compliance-pipeline privilege assignment, reporter→CI artifact report content, Guest reads confidential epics.

  • Cross-target fold: Docker Hub GhostPat (CVE-2026-105445, fixed server-side 2026-09-30) demonstrated account→org conversion reassigning live PATs to the receiving identity without rotation. The skillz grep heuristic names GitLab/Gitea/Forgejo org-conversion and merge handlers as self-hosted twins: check whether the transition handler re-points a token's owning user without invalidating the secret — absent rotation = standing ATO primitive. Test only with two accounts you own on in-scope deployments. Source: https://github.com/advisories/GHSA-phq5-vq2m-8rp9 , https://ghostpat.com

  • 2026-10-07 — CSV-import Sidekiq DoS (CVE-2026-1403, CVSS 6.5, GHSA-6w5v-7h2v-438h, unreviewed tier) — improper validation of CSV file structure on import lets an authenticated user cause denial of service to Sidekiq workers. Affected: CE/EE all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, 18.10 before 18.10.3. Hunting read: per the 2026-01-20 bounty-policy update, application-layer DoS is out of scope (except persistent total disruption via unauthenticated endpoints), so this is recorded as patch-posture/self-hosted-fingerprint intel, not a hunt vector. Weak-signal value only: the CSV-import path confirms user-upload parsing flows into Sidekiq job payloads — structural-validation gaps in import handlers remain a data-integrity/authz probe lane, not a DoS one. Source: https://github.com/advisories/GHSA-6w5v-7h2v-438h (collected 2026-10-08 eighteenth sweep; confirm against live advisory).

  • 2026-10-02 — GitLab AI Gateway RCE (CVE-2026-90970, CVSS 9.9, CWE-1336) — an authenticated user with Duo Agent Platform access can escape the prompt-template sandbox of a custom flow via a specially crafted flow configuration, achieving arbitrary command execution on self-hosted AI Gateway instances. Fixed in gateway 19.2.4 / 19.3.2 / 19.4.1; affected range spans 18.1.6 through the 19.1 line (no fix for <19.2.4 on older lines) plus 19.3 <19.3.2 and 19.4 <19.4.1. GitLab.com / GitLab Dedicated / GitLab-hosted gateway are already protected; self-hosted gateway operators must patch — no workaround listed. Self-hosted gateways hold JWT signing keys and sit between the instance and AI model providers, so compromise cascades to AI-workflow auth tokens. CISA added an "exploitation: none" assessment on 2026-10-02; no public PoC as of 2026-10-03. Reported by HackerOne user invisiblemeerkat. Hunting read: this is the second CWE-1336 template-engine sandbox escape in the same gateway/flow component (after CVE-2026-1868, 9.9, Feb 2026 — crafted flow definition → DoS/RCE). Two recurrences in one year make the Duo Agent Platform custom-flow template engine a priority probe surface: flow-configuration parsing, prompt-template injection, and sandbox boundary confinement on any AI-agent orchestration feature. Strengthens the standing AI-surface hypothesis on this program (Duo trace reads CVE-2026-92470 → GraphQL subscription deserialization CVE-2026-87719 → gateway template escape CVE-2026-90970: three consecutive waves where Duo/AI surfaces were the privileged path). Sources: https://about.gitlab.com/releases/ (gateway security release 2026-10-02), NVD CVE-2026-90970 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), press coverage: BleepingComputer / realhacker.news / deafnews.it (all 2026-10-02/03).

  • 2026-09-10/12 — Critical patch wave (19.3.2 / 19.2.6 / 19.1.8; backported 2026-09-23 to 19.0.9 / 18.11.12). Two headliners, both directly relevant to GitLab.com-adjacent hunting:
  • CVE-2026-85706 (CVSS 10.0, CISA KEV-listed 2026-09-11) — unauthenticated arbitrary file read from the GitLab server via improper path confinement + missing authentication enforcement in the repository commits API (CE/EE ≥18.7 <18.11.12, <19.0.9, <19.1.8, <19.2.6, <19.3.2). KEV listing means active real-world exploitation. Hunting read: commit-log/path join points on repository APIs deserve auth-parity probing across route families and path canonicalization checks against server root. Source: https://github.com/advisories/GHSA-f47w-mrg9-g9p2 , https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • CVE-2026-87719 (CVSS 9.9, EE-only) — authenticated user with Duo Chat access obtains Advanced Search instance configurations and sensitive credentials via a crafted GraphQL subscription argument that bypasses serialization to perform server object lookup (≥18.3 <18.11.12, <19.0.9, <19.1.8, <19.2.6, <19.3.2). Second consecutive wave where an AI-assistant feature (after CVE-2026-92470's Duo trace reads) serves as an authorization proxy over a privileged data path — standing hypothesis: Duo/AI surfaces on GitLab.com warrant argument-deserialization and object-lookup confinement probes. Source: https://github.com/advisories/GHSA-prp4-5w2g-8v2c
  • Wave also included: GraphQL complexity-limiter DoS x2 (High), CI/CD protected-variable access via Scheduled Pipeline Execution Policy test (High, CVE-2026-79708), CI/CD env-var scope-matcher incorrect authorization (High), SAML SSO sign-in restriction auth flaw (Medium), Workhorse senddata credential exposure (Medium), Generic Package Registry missing authorization (Medium). Verified against live advisories + KEV catalog on 2026-10-02.
  • 2026-09-24/29 — 11-record patch wave (19.2.7 / 19.3.3 / 19.4.1), incl. two CVSS 9.9 authenticated RCEs via user-authored regex in CI/CD config. Integer overflow when compiling a specially crafted regex in a CI/CD configuration → arbitrary code execution on the server (9.9, CVE-2026-93577, GHSA-wqwg-376r-c226) and a double free when parsing a crafted regex in a CI/CD config → same sink (9.9, CVE-2026-89078, GHSA-9chr-4x58-948m). Also in the wave: 8.7 stored XSS via improper sanitization of path components in the MR diff viewer (CVE-2026-84739); 7.7 EE-only — Duo AI troubleshooting feature exposed sensitive CI/CD variable values from debug-mode job traces due to missing authorization checks (CVE-2026-92470) — an AI feature acting as an authorization-bypass proxy over an existing data path; remainder low/medium. Wave collected from the unreviewed advisory tier; descriptions verified against live advisories on 2026-10-01. Recon/validation note: self-hosted instances ≥19.2 <19.2.7 that run CI with user-controlled regex (.gitlab-ci.yml rules, variables patterns) are a known-good validation target for the regex-compiler sink; the Duo/traces path is a standing authorization test on any AI-assistant feature that reads job artifacts. Also in-wave, newly named surface: the GitLab MCP API took two advisories (scope-enforcement incorrect authorization CVE-2026-92874, Medium; gitlab_search tool race condition CVE-2026-92628, Low) — MCP endpoints are a young surface on GitLab.com and warrant scope/token-boundary probes distinct from the REST/GraphQL equivalents. Sources: https://github.com/advisories/GHSA-wqwg-376r-c226, https://github.com/advisories/GHSA-9chr-4x58-948m, https://github.com/advisories/GHSA-hrj5-qwx9-f2q7, https://github.com/advisories/GHSA-f2v3-pf6x-rw2j
  • 2026-08-23 — Package Registry Path Traversal → RCE (High). GitLab CE/EE: an authenticated user could achieve remote code execution via a path traversal in the package registry. Affected: 18.8 < 19.0.6, 19.1 < 19.1.4, 19.2 < 19.2.2. Durable attack-surface note: the package-registry stored-file and package-name canonicalization path is a testable boundary when a low-privilege account can influence package or artifact identifiers. Source: https://github.com/advisories/GHSA-2fpv-gqh2-qq5r (CVE-2026-10053)

Technical Characteristics

  • Ruby on Rails: Primary application framework
  • Microservices: Modern distributed architecture
  • Container-Based: Heavy use of Docker and Kubernetes
  • Git-Centric: All functionality built around Git workflow

Research Considerations

  • Complex Permissions: Sophisticated role-based access control system
  • CI/CD Security: Unique attack vectors in DevOps pipeline
  • Multi-Tenancy: Isolation between different organizations/projects
  • Integration Points: Extensive third-party integrations

Last Enumeration: 2025-09-01
Last Intel Review: 2026-10-28 (advisory-watch re-check #57 — STAGED-WAVE ESCALATION: second unannounced cut observed. foss tags API + both-repo ls-remote show NEW tags v19.5.3 (commit 2026-10-28T05:08:09Z) and v19.4.5 (commit 05:16:32Z), mirrored on the EE side in gitlab-org/gitlab (v19.5.3-ee + v19.4.5-ee now newest). v19.3 and v18.11 lines did NOT advance (v19.3.7/v18.11.14 still newest there) — the second cut is partial, covering only the two newest release lines. Six staged-but-unannounced tags now live across four supported lines (19.5.2+19.5.3, 19.4.4+19.4.5, 19.3.7, 18.11.14). Announcement surfaces still silent: articles/19-5-2/ and articles/19-5-3/ hard 404, releases + whats-new pages carry zero 19.5.x mentions, patch-releases.xml still 404. Hunting read: a re-cut on two lines ~20h after the original quartet cut (tag re-rolls happen when additional fixes are queued into a pending security release) shifts probability AWAY from the ~2026-11-11 bundling hypothesis and TOWARD an imminent announcement — expedited/below-cadence security releases historically drop within days of repeated tag activity; treat the watch as high-tempo and keep polling tight. GHSA-25hh-xvj4-2cqv + GHSA-4prq-p2x5-w9fh still 404 mirror pending; AWS index unchanged 2026-152-AWS; no new GitLab GHSA advisories in the feed. Pruned re-check #56 line to condensed form (preserved in git history). Earlier 2026-10-28, re-check #56: staged quartet still unannounced ~19h post-cut both sides (tag commits 09:34–09:44Z); announcement surfaces silent (article URLs 302-soft SPA catch-all, whats-new 404, patch-releases.xml 404→302 shift); sweep-84 since-poll from sweep-81 CUT 2026-10-27T23:04:33Z returned 105 new advisories [103unrev/0rev/2mal] — net-new 03:31Z wave ~46 (LibreSSL x4, libexpat x2, llama.cpp RDMA 8.1, CrushFTP CSRF 8.8, WP x5, 6 rejections) + 2 malware (trajmetrics PyPI, glyphmatrix-fixture); zero target hits (lone 'amazon' candidate = WP-plugin substring false-positive) (full text in git history). Earlier 2026-10-28, re-check #55: staged quartet still unannounced ~17h post-cut both sides; patch-releases.xml feed had shifted to hard 404; sweep-83 returned ZERO new advisories — quietest since sweep-80; zero target hits. Earlier 2026-10-28, re-check #54: staged quartet still unannounced ~15h post-cut both sides; sweep-82 returned 64 advisories [64unrev] dominated by Chrome 156.0.8078.73 stable mirror wave (~52) + eMudhra eight-intermediate-CA key compromise GHSA-433q-6ghj-2qwf noted for supply-chain revocation watch; zero target hits. Earlier 2026-10-27, re-check #53: staged quartet still unannounced ~14h post-cut on both sides (main ls-remote v19.5.2-ee + foss tag API quartet newest); 19.5.2 candidate article URLs shifted from hard 404 to 301-soft-redirect onto the docs releases SPA catch-all; sweep-81 returned 7 advisories [0unrev/0rev/7mal] — single npm typosquat family (seven csec/ccsseecc/ccsec x form-validator/crypto-toolkit variants), zero target hits (full text in git history). Earlier 2026-10-27, re-check #52: staged quartet still unannounced ~13h post-cut on both EE and CE sides (foss tags API + main ls-remote re-confirmed all four newest), announcement surfaces 404/CF-interstitial; sweep-80 returned ZERO advisories globally — quietest sweep of the series (full text in git history). Earlier 2026-10-27, re-check #51: staged quartet still unannounced ~12h post-cut on both EE and CE sides (foss tags API listed all four CE tags newest); sweep-79 returned 38 advisories [23unrev/14rev/1mal] zero keyword hits — reviewed tier substantive for the agent-tooling lane: MCP Python SDK trio GHSA-w4fh-qvv9-3v23 bearer-aud bypass (class twin of AWS 2026-152 CVE-2026-115413; fix OFF-by-default behind validate_token_resource — upgrade-without-enabling stays vulnerable), GHSA-5h93-6whr-6q8j cross-origin redirect header/body leak, GHSA-rwrf-2pqf-9j8j server-chosen schema-$ref SSRF/file-read + event-loop freeze (agent-bridge probe battery extended); MLflow unauth pair critical RCE scorer-deserialization + schemeless-path file-read patch-bypass of CVE-2026-2614, both <3.17.0; Atlantis GHSA-rjh2-4xgw-p2hj PR-workspace-name shell-injection RCE <=0.47.0, fourth IaC/deploy-pipeline generator-injection this fortnight (full text in git history). Earlier 2026-10-27, re-check #50: staged quartet still unannounced ~11h post-cut (main ls-remote v19.5.2-ee newest, announcement surfaces 403/404); sweep-78 quietest sweep since sweep-70 — single PyPI typosquat dsh-vm-tester, zero target hits (full text in git history). Earlier 2026-10-27, re-check #49: staged quartet still unannounced ~9.5h post-cut, main-repo ls-remote also carried v19.5.2-ee by then; sweep-77 returned 10 advisories [0unrev/10rev/0mal], first zero-unreviewed-tier sweep of the series — undici x5 cluster + MCP TypeScript SDK GHSA-f897-62hf-6gxq 7.5 (HTTP transports no POST-body-size/JSON-RPC-batch-length limit → unauth memory-exhaustion DoS, fixed 1.30.½.1.0/2.0.1, express.json() NOT protective — resource-exhaustion axis folded into agent-bridge probe battery, fingerprint pre-fix servers by >4MiB POST tolerance) + Symfony YAML/ReDoS pair + go-jose JWK DoS + CTFd terraform state leak; zero target hits (full text in git history). Earlier 2026-10-27, re-check #48: staged quartet still unannounced ~9h post-cut; sweep-76 returned 118 advisories [117unrev/0rev/1mal] dominated by Adobe Campaign Classic + Tanium x31 vendor mirror waves, malware single numprint PyPI typosquat, zero target keyword hits; both bulletin-referenced GHSAs (25hh, 4prq) 404 — bulletin-before-mirror lag twice-observed; AWS index ADVANCED 2026-151→2026-152-AWS with CVE-2026-115413 OAuth audience bypass folded to amazonvrp page (full text in git history). Earlier 2026-10-27, re-check #47: staged quartet still unannounced ~8h post-cut, sweep-75 single reviewed hit (Hydra unsafe-PyYAML 7.8), zero target hits (full text in git history). Earlier 2026-10-27, re-check #46 confirmed-positive first sighting of the staged-but-unannounced quartet + sweep-74 17 advisories [7rev/10mal] zero hits (full text in git history). Earlier 2026-10-27, re-check #45 POSITIVE: first sighting of the four staged EE tags (19.5.2/19.4.4/19.3.7/18.11.14) + sweep-73 420 advisories with strands-agents pair folded to amazonvrp (full text in git history). Earlier 2026-10-27, re-check #44: sweep-72 returned 22 advisories [22unrev/0rev/0mal, malware tier empty second consecutive sweep] — zero keyword hits; EE tags unchanged; AWS index unchanged (full text in git history). Earlier 2026-10-27, re-check #43: sweep-71 returned 74 advisories [74unrev/0rev/0mal, first zero-malware sweep of the hijack-wave series], 1 REAL keyword hit folded — GHSA-v5m9-m7pg-q8f3 / CVE-2026-111422 apache-airflow-providers-ssh <7.0.1 SSHRemoteJobOperator templated-environment quote-context injection → DAG-trigger-only user remote-host RCE (amazonvrp page, third IaC/task-generator injection in the lane after SAM CLI + redshift-alpha); zero GitLab hits; EE tags unchanged (full text in git history). Earlier 2026-10-26, re-check #42 negative: sweep-70 since-poll from sweep-69 CUT 2026-10-26T21:36:29Z returned zero new advisories [0unrev/0rev/0mal] — feed quiet globally since 21:36Z; GHSA-25hh-xvj4-2cqv still not resolvable; EE tags unchanged; AWS index unchanged 2026-151-AWS. Earlier 2026-10-26, re-check #41 negative for GitLab but POSITIVE via AWS index advance: sweep-69 returned 540 truly-new advisories [515 unreviewed + 0 reviewed + 25 malware, newest published globally 2026-10-26T21:36:29Z] as of 21:45 UTC — the unreviewed tier is dominated by a 226-advisory Apple patch-tuesday GHSA mirror wave (iOS 26.7.2/27.2, iPadOS, macOS Golden Gate 27.2, Safari 27.2, plus 13 rejected/withdrawn CVE entries), remainder third-party CVE-fodder (TOTOLINK A950RG x3 incl. 9.9 pair, HashiCorp Consul/Consul-Enterprise authorization-bypass + DoS family x5, Routinator RRDP/CRL issues x7, Esri ArcGIS Server/Portal x5 incl. 9.8 SQLi CVE-2026-10757, libosmocore/libosmo-sigtran/osmo-msc telecom parser OOB x8, Netty netty-tcnative x5, Open5GS x2, a2aproject a2a-java/go/dotnet x4, Apache Vysper x2 unsupported, DeepSeek Harness x2, OpenHands agent-SDK unauth RCE 9.8 CVE-2026-112346, LeRobot unsafe dynamic class loading, Xpdf, jose ECDSA non-canonical signature acceptance, Consul-k8s cross-namespace authz bypass 9.9); malware tier is a 25-package continuation of the hijacked-scoped-enterprise wave (@ppa-web-components x6, @greenlake x5, @drone-js-ext x2, @capsense x2, @sxm-web, @iobandamwer x2, @eforms, path-stream-utils-testmetest, jshelperdependenceny + css-shim typosquats postcss-semantic-themes/birch-css-utils/harlow-css-mixer, 'Malware in X' summary format continuing); ZERO keyword hits across all tiers for the full target keyword list incl. aws/sagemaker/freertos/strands — the AWS-related news this window bypassed the advisory feed entirely (2026-151-AWS CVE-2026-115418 CDK aws-redshift-alpha SQLi published 16:30Z has no GHSA mirror yet — bulletin-referenced GHSA-25hh-xvj4-2cqv unresolvable via API at check time, folded same-evening to the amazonvrp page); git ls-remote gitlab-org/gitlab EE tags unchanged — v19.5.1-ee still newest; AWS security-bulletins index ADVANCED 2026-150→2026-151-AWS [checked via aws.amazon.com/security/security-bulletins/]). Earlier 2026-10-26, re-check #40 negative: sweep-68 since-poll returned 165 truly-new advisories [122unrev/0rev/43mal] — third-party CVE-fodder (Oray Pugongying x7 9.9-topped, NocoDB x5, WooCommerce/FunnelKit x7, libimobiledevice x5, SOEM 8.8, HTTP/2 RSTTREAM DoS) 43-pkg malware tier with GHSA summary-format shift ('Malware in X' sans ecosystem suffix), @s4yhiitestpoc 10-pkg scanner-PoC family, scoped-enterprise hijack continuation (@greenlake/@capsense/@sxm-web), AI-tooling PyPI typosquats + css-shim family; 3 keyword hits zero relevance (FluxCP PayPal-IPN third-party forum software, publish-poc-'amazon= amazon-inspector attribution only); zero GitLab/target keyword hits; EE tags unchanged; AWS index unchanged 2026-150-AWS. (Earlier re-checks #22–#39 and sweep-46/47 GitLab 19.5.1 patch-wave fold — full text preserved in git history.)
Next Review: 2026-11-01
Analyst: Bastet Security Research Team

Current public scope

Verified public scope and policy

Historical research notes on this page are not verified authorization or current scope. Consult the linked public snapshot and the current HackerOne policy before testing.