PT-2026-28096 · Gitlab · Gitlab Ce/Ee

Maksyche · Publicado 2026-03-25 · Atualizado 2026-03-31 · CVE-2026-2370

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 14.3 through 18.8.6 GitLab CE/EE versions 18.9 through 18.9.2 GitLab CE/EE versions 18.10 through 18.10.0

Description An issue exists in GitLab CE/EE related to Jira Connect installations where an authenticated user with minimal workspace permissions could potentially obtain installation credentials and impersonate the GitLab application. This is due to improper authorization checks.

Recommendations Update GitLab CE/EE to version 18.8.7 or later. Update GitLab CE/EE to version 18.9.3 or later. Update GitLab CE/EE to version 18.10.1 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-233

Identificadores relacionados

BDU:2026-04333

BIT-GITLAB-2026-2370

CVE-2026-2370

Produtos afetados

Gitlab Ce/Ee

Referências · 15

• 🔥 https://hackerone.com/reports/3522829 · Exploit
• https://twitter.com/CVEnew/status/2038516974440079834 · Publicação no Twitter
• https://twitter.com/ptdbugs/status/2038516570373099701 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2026-2370 · Aviso do Fabricante
• https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released · Correção
• https://osv.dev/vulnerability/BIT-gitlab-2026-2370 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2038410893697208646 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2026-2370 · Nota de Segurança
• https://twitter.com/CosmicBytez/status/2038726997430747435 · Publicação no Twitter
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-2370 · Aviso do Fabricante
• https://twitter.com/the_yellow_fall/status/2036786425954189790 · Publicação no Twitter
• https://twitter.com/CVEarity/status/2038593172973158750 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-2370 · Nota de Segurança
• https://gitlab.com/gitlab-org/gitlab/-/work_items/589635 · Nota
• https://bdu.fstec.ru/vul/2026-04333 · Nota de Segurança