Report feedback

An authenticated remote attacker with the Developer role can, after user interaction, execute arbitrary commands in the CI context because GitLab EE processes the Claude agent configuration from a user-controlled source [1][2].

The vulnerability is present in product:

• GitLab Enterprise Edition; >=18.9, <19.1.7; >=19.2, <19.2.5; >=19.3, <19.3.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

More information:

• CVE-2026-18252 at cve.org, NVD
• CWE-829: Inclusion of Functionality from Untrusted Control Sphere at cwe.mitre.org

The vulnerability was publicly disclosed 26. 8. 2026.

An authenticated remote attacker can perform a DoS attack affecting background job processing due to a missing limit on the number of processed objects in the GitLab CE/EE import pipeline [1][3].

The vulnerability is present in products:

• GitLab Community Edition; >=12.8, <19.1.7; >=19.2, <19.2.5; >=19.3, <19.3.1
• GitLab Enterprise Edition; >=12.8, <19.1.7; >=19.2, <19.2.5; >=19.3, <19.3.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

More information:

• CVE-2026-77801 at cve.org, NVD
• CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org

The vulnerability was publicly disclosed 26. 8. 2026.

An authenticated remote attacker can perform a DoS attack due to an infinite loop when processing specially crafted data in the SCIM user provisioning feature of GitLab EE [1][4].

The vulnerability is present in product:

• GitLab Enterprise Edition; >=11.10, <19.1.7; >=19.2, <19.2.5; >=19.3, <19.3.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

More information:

• CVE-2025-10903 at cve.org, NVD
• CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') at cwe.mitre.org

The vulnerability was publicly disclosed 26. 8. 2026.