EN PT-BR
← Voltar ao feed
medium

CERT-FR Advisory: GitLab Security Policy Bypass Vulnerability (CVE-2026-111943)

1 fonte(s) · 1 atualização(ões) · publicado 29/10/2026 21:00 · coletado há 2 horas

The French CERT-FR issued advisory CERTFR-2026-AVI-1427 on a vulnerability affecting GitLab Community Edition (CE), Enterprise Edition (EE), and AI Gateway that allows an attacker to bypass security policy. The flaw is tracked as CVE-2026-111943 and is addressed in GitLab's 29 October 2026 security bulletin. No active exploitation is mentioned in the advisory.

Entenda a falha

A vulnerabilidade

CVE-2026-111943 is a security policy bypass in GitLab Community Edition, Enterprise Edition and GitLab AI Gateway, per CERT-FR advisory CERTFR-2026-AVI-1427. The advisory gives no CVSS score, no flaw class and no conditions such as authentication or network reach. Affected GitLab CE/EE versions are those before 19.0.11, 19.1.10, 19.2.10, 19.3.7, 19.4.5, 19.5.3 and 18.11.14. AI Gateway is affected before 19.0.13, 19.1.9, 19.2.5, 19.3.3, 19.4.3, 19.5.3 and 18.11.8. Fixes are in GitLab's 29 October 2026 patch release. No active exploitation is mentioned.

Como funciona

The articles do not describe how the vulnerable process works. They only say that an attacker can cause a bypass of the security policy, without saying which input or component is involved or at which step the policy is not enforced.

Por que é vulnerável

The root cause is not stated in the advisory. It only says a vulnerability was found that lets an attacker bypass the security policy, and refers readers to the vendor bulletin for fixes. What the fix changes is not described.

Como foi descoberta

The articles do not say who found the flaw or how. CERT-FR published its advisory on 30 October 2026, referring to GitLab's security bulletin of 29 October 2026 and to the CVE record. The advisory does not mention exploitation.

Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 12:19.

Detalhes técnicos

  • Affects AI Gateway versions prior to 19.0.13, 19.1.9, 19.2.5, 19.3.3, 19.4.3, 19.5.3, and prior to 18.11.8.
  • Affects GitLab CE/EE versions prior to 19.0.11, 19.1.10, 19.2.10, 19.3.7, 19.4.5, 19.5.3, and prior to 18.11.14.
  • The vulnerability allows a security policy bypass; no CVSS score or exploitation conditions detailed.

Remediação

  • Update GitLab CE/EE and AI Gateway to the fixed versions listed in the GitLab 29 October 2026 patch release bulletin.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 29/10/2026 21:00 · coletado 03/11 12:02 primeiro registro

    CERT-FR Advisory: GitLab Security Policy Bypass Vulnerability (CVE-2026-111943)

    ler a análise desta fonte

    The French CERT-FR issued advisory CERTFR-2026-AVI-1427 on a vulnerability affecting GitLab Community Edition (CE), Enterprise Edition (EE), and AI Gateway that allows an attacker to bypass security policy. The flaw is tracked as CVE-2026-111943 and is addressed in GitLab's 29 October 2026 security bulletin. No active exploitation is mentioned in the advisory.

    Technical Details

    • Affects AI Gateway versions prior to 19.0.13, 19.1.9, 19.2.5, 19.3.3, 19.4.3, 19.5.3, and prior to 18.11.8.
    • Affects GitLab CE/EE versions prior to 19.0.11, 19.1.10, 19.2.10, 19.3.7, 19.4.5, 19.5.3, and prior to 18.11.14.
    • The vulnerability allows a security policy bypass; no CVSS score or exploitation conditions detailed.

    Remediation

    • Update GitLab CE/EE and AI Gateway to the fixed versions listed in the GitLab 29 October 2026 patch release bulletin.