PT-2026-24702 · Gitlab+2 · Gitlab

Shells3C · Published 2026-03-11 · Updated 2026-03-15 · CVE-2026-3848

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 8.11 through 18.7.5 GitLab CE/EE versions 18.8 through 18.8.5 GitLab CE/EE versions 18.9 through 18.9.1

Description An issue in GitLab CE/EE could allow an authenticated user to make unintended internal requests through proxy environments. This is due to improper input validation within the import functionality.

Recommendations GitLab versions prior to 18.7.6 should be updated. GitLab versions prior to 18.8.6 should be updated. GitLab versions prior to 18.9.2 should be updated.

Fix

Weakness Enumeration

CWE-93

Related Identifiers

BIT-GITLAB-2026-3848

CVE-2026-3848

Affected Products

Gitlab

References · 9

• https://ubuntu.com/security/CVE-2026-3848 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3848 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2026-3848 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3848 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-3848 · Security Note
• https://gitlab.com/gitlab-org/gitlab/-/work_items/577298 · Note
• https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released · Note
• https://twitter.com/infoflowcloud/status/2032999228016885816 · Twitter Post
• https://twitter.com/CVEnew/status/2032998328724521117 · Twitter Post