wid-sec-w-2026-0847 · Published 2026-03-24 · View on BSI CERT-Bund ↗

GitLab: Multiple Vulnerabilities

CVSS 8.1 HIGH

Risk Summary

GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to access API tokens of self-hosted AI models due to improper access control.

CVEs (12)

CVE-2025-13078 CVE-2025-13436 CVE-2025-14595 CVE-2026-1724 CVE-2026-2370 CVE-2026-2726 CVE-2026-2745 CVE-2026-2973 CVE-2026-2995 CVE-2026-3857 CVE-2026-3988 CVE-2026-4363

Affected Vendors

Open Source

Affected Products (6)

Open Source · GitLab <18.10.1

Open Source · GitLab 18.10.1

Open Source · GitLab <18.9.3

Open Source · GitLab 18.9.3

Open Source · GitLab <18.8.7

Open Source · GitLab 18.8.7

Get alerted to advisories like this

OTWarden monitors CISA, BSI, Siemens, Rockwell and more — and emails you within 2 hours when your vendors are affected.

Start free trial Learn more