Multiple vulnerabilities affecting Gitlab CE/EE

GitLab Community Edition (CE) and Enterprise Edition (EE) are DevOps lifecycle management platforms enabling source code repository hosting, collaboration, and continuous integration/continuous deployment (CI/CD). These solutions are affected by several vulnerabilities labeled as follows: CVE-2026-85706 (CVSS 10.0): Reading arbitrary files via the repository validation API, due to incorrect path limiting and lack of authentication checks. Exploitation of this vulnerability would allow an unauthenticated attacker to read arbitrary files on the GitLab server. CVE-2026-87719 (CVSS 9.9): Access to advanced search instance configurations and sensitive credentials via the GraphQL subscription serializer, due to insecure deserialization. Exploitation of this vulnerability would allow an authenticated attacker with access to Duo Chat to obtain this sensitive information. CVE-2026-88765 (CVSS 8.5): Remote code execution via the Unicode conversion wrapper used for advanced search indexing, due to a buffer overflow. Exploitation of this vulnerability would allow an authenticated attacker to execute code remotely by importing a specially crafted Git project export. CVE-2026-79708 (CVSS 8.5): Access to protected CI/CD variables via execution of pipeline strategy tests, due to insufficient scope validation. Exploitation of this vulnerability would allow an authenticated attacker with developer rights to access protected CI/CD variables reserved for more privileged roles. CVE-2026-78252 (CVSS 8.2): Execution of unintended HTTP state modification requests via the JSON Markdown table renderer, due to improper sanitization of user-controlled data. Exploitation of this vulnerability would allow an authenticated malicious actor to cause these requests to be executed. CVE-2026-13210 (CVSS 7.7): Access to CI/CD variables outside of intended scope via the scope matching model of CI/CD environments, due to improper input validation. Exploitation of this vulnerability would allow an authenticated attacker to access CI/CD variables outside the scope of their intended environment. CVE-2026-1168 (CVSS 7.5): Denial of service via GraphQL complexity calculation logic, due to inappropriate resource allocation limits. Exploitation of this vulnerability would allow an unauthenticated malicious actor to cause a denial of service affecting the availability of the GitLab instance. CVE-2026-12910 (CVSS 5.4): Bypass SAML SSO login restrictions via the login restriction mechanism, due to insufficient authentication enforcement controls. Exploitation of this vulnerability would allow an authenticated malicious actor to authenticate without going through SSO. CVE-2026-82837 (CVSS 5.3): Access to sensitive credentials and tokens through Workhorse's internal data issuing endpoints, due to inadequate authorization controls. Exploiting this vulnerability would allow a malicious actor to access this information without going through the intended proxy. CVE-2026-19619 (CVSS 4.7): Execution of arbitrary JavaScript code via the content editor, due to inadequate sanitization of user-controlled HTML content. Exploitation of this vulnerability would allow an unauthenticated attacker to execute arbitrary JavaScript code in the context of a targeted user's session. CVE-2026-86341 (CVSS 4.4): Bypassing requirements for approval of protected environment deployments via modification of a protected resource, due to incorrect access controls applied after this modification. Exploitation of this vulnerability would allow an authenticated attacker with owner or maintainer privileges to allow unapproved deployments to production. CVE-2026-86340 (CVSS 4.4): Bypassing required deployment approvals via protected environment trust rules, due to a bypass of authorization mechanisms. Exploitation of this vulnerability would allow an authenticated attacker to bypass required approvals by removing the single approver group or user account. CVE-2026-7514 (CVSS 4.3): Modification of the contents of package files via the generic package registry, due to incorrect authorization checks. Exploitation of this vulnerability would allow an authenticated attacker with developer privileges to modify the contents of package files and hide the packages from their owners. CVE-2026-8030 (CVSS 4.3): Blocked modification of group settings via namespace transfers, due to incorrect validation of group URL slugs. Exploiting this vulnerability would allow an authenticated attacker to prevent another user from changing their group settings. CVE-2026-16794 (CVSS 4.3): Execution of arbitrary CI/CD tasks and access to protected variables via compliance framework management, due to inadequate authorization controls. Exploitation of this vulnerability would allow an authenticated attacker with the Security Officer role to execute arbitrary CI/CD tasks and access protected variables within group projects

• GitLab CE/EE, versions prior to 19.1.8, 19.2.6 and 19.3.2;
• GitLab EE, versions prior to 19.1.8, 19.2.6 and 19.3.2;
• GitLab CE/EE, versions 18.4.6 to 19.1.8, 19.2 to 19.2.6, and 19.3 to 19.3.2;