Patch GitLab CE/EE for Exploited Critical Code Injection Flaw
NEOSEC enrichment — no mirror of the original source
On August 17, 2026, GitLab released out-of-cycle patches for a critical vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE), and researchers observed exploitation attempts within two days of the disclosure. CVE-2026-1
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Editorial context in the original issue
The SANS NewsBites issue carries commentary by: Bischoping, Frost, Neely, Skoudis.
Linked advisories
- CVE-2026-19650Cross-Site Request Forgery (CSRF) in GitLab
- CVE-2026-19650bitnami gitlab: Cross-Site-Request-Forgery (CSRF)
- CVE-2026-19478bitnami gitlab: Code-Injection
- CVE-2026-19478GitLab: Mehrere Schwachstellen ermöglichen Manipulation von Dateien
- CVE-2026-19478Improper Control of Generation of Code ('Code Injection') in GitLab
Affected vendors and products
More on GitLab
Other advisories
- CriticalCVE-2026-105458GitLab: Mehrere Schwachstellen
- HighCVE-2026-16255Incorrect Authorization in GitLab
- HighCVE-2026-15723Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab
- LowCVE-2026-14288Use of Incorrectly-Resolved Name or Reference in GitLab
- MediumCVE-2026-13319Authorization Bypass Through User-Controlled Key in GitLab
- MediumCVE-2026-12664Incorrect Authorization in GitLab
- MediumCVE-2026-112378Use of Less Trusted Source in GitLab
- LowCVE-2026-112326Improper Cleanup on Thrown Exception in GitLab
Other news entries
- CISA says max severity GitLab flaw now exploited in the wildNewsBleepingComputer
- Angriff auf Ruby-Lücke: Alpine Linux muss Gitlab-Instanz komplett neu aufsetzenNewsGolem.de — Security
- Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxNewsSecurityWeek
- Cisco-Firewalls und GitLab-Lücke werden angegriffenNewsheise Security
- Hinter kritischen GitLab-Lücken stecken Fehler in der Regex-Engine von RubyNewsheise Security
- CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEVNewsThe Hacker News
- Vulnérabilité dans GitLab (30 octobre 2026)NewsCERT-FR (ANSSI)
- Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left OpenNewsThe Hacker News
ID