/
← Voltar ao feed
high

CERT-FR warns of multiple GitLab CE/EE vulnerabilities including remote code execution, fixed in 19.3.6, 19.4.3 and 19.5.1

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 21:00 · coletado há 6 horas

The CERT-FR published advisory CERTFR-2026-AVI-1363 on multiple vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). Exploitation can lead to remote arbitrary code execution, breach of data confidentiality and security policy bypass. The advisory relays the vendor's security bulletin of 21 October 2026 and lists 13 CVE identifiers. The article does not mention active exploitation.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1363 covers multiple vulnerabilities in GitLab Community Edition and Enterprise Edition. Exploitation can lead to remote arbitrary code execution, loss of data confidentiality and security policy bypass. Affected: all versions before 19.3.6, 19.4.x before 19.4.3 and 19.5.x before 19.5.1. The advisory does not map CVEs to impacts, so it is unclear which CVE gives which result or what access an attacker needs. The story says 13 CVEs but lists 12: CVE-2026-103515, -105711, -105777, -110264, -112212, -112326, -112378, -12664, -13319, -14288, -15723 and -16255. No active exploitation is mentioned.

Como foi descoberta

The CERT-FR advisory, published on 22 October 2026, relays GitLab's security bulletin of 21 October 2026 (patch release 19.5.1). The articles do not say who found the flaws or how they were reported. They only state that the vulnerabilities were discovered in GitLab and that fixes are in the vendor bulletin.

Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 12:19.

Detalhes técnicos

  • Affected versions: GitLab CE/EE 19.4.x before 19.4.3, 19.5.x before 19.5.1, and all versions before 19.3.6.
  • Referenced CVEs: CVE-2026-103515, CVE-2026-105711, CVE-2026-105777, CVE-2026-110264, CVE-2026-112212, CVE-2026-112326, CVE-2026-112378, CVE-2026-12664, CVE-2026-13319, CVE-2026-14288, CVE-2026-15723, CVE-2026-16255.
  • The advisory does not map individual CVEs to specific impacts.

Remediação

  • Apply the patches described in the GitLab patch release bulletin for 19.5.1 (21 October 2026), upgrading to 19.3.6, 19.4.3 or 19.5.1 or later depending on the branch in use.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 21/10/2026 21:00 · coletado 23/10 12:01 primeiro registro

    CERT-FR warns of multiple GitLab CE/EE vulnerabilities including remote code execution, fixed in 19.3.6, 19.4.3 and 19.5.1

    ler a análise desta fonte

    The CERT-FR published advisory CERTFR-2026-AVI-1363 on multiple vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). Exploitation can lead to remote arbitrary code execution, breach of data confidentiality and security policy bypass. The advisory relays the vendor's security bulletin of 21 October 2026 and lists 13 CVE identifiers. The article does not mention active exploitation.

    Technical Details

    • Affected versions: GitLab CE/EE 19.4.x before 19.4.3, 19.5.x before 19.5.1, and all versions before 19.3.6.
    • Referenced CVEs: CVE-2026-103515, CVE-2026-105711, CVE-2026-105777, CVE-2026-110264, CVE-2026-112212, CVE-2026-112326, CVE-2026-112378, CVE-2026-12664, CVE-2026-13319, CVE-2026-14288, CVE-2026-15723, CVE-2026-16255.
    • The advisory does not map individual CVEs to specific impacts.

    Remediation

    • Apply the patches described in the GitLab patch release bulletin for 19.5.1 (21 October 2026), upgrading to 19.3.6, 19.4.3 or 19.5.1 or later depending on the branch in use.