PT-2026-31539 · Gitlab · Gitlab Ce/Ee

Sim4N6 · Published 2026-04-08 · Updated 2026-04-13 · CVE-2026-1101

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.2 through 18.8.9, 18.9 through 18.9.5, and 18.10 through 18.10.3

Description The issue involves improper input validation in GraphQL queries, potentially allowing an authenticated user to cause a denial of service to the GitLab instance.

Recommendations Update to GitLab EE version 18.8.9 or later. Update to GitLab EE version 18.9.5 or later. Update to GitLab EE version 18.10.3 or later.

Exploit

Fix

Weakness Enumeration

CWE-1284

Related Identifiers

BDU:2026-04883

BIT-GITLAB-2026-1101

CVE-2026-1101

Affected Products

Gitlab Ce/Ee

References · 11

• 🔥 https://hackerone.com/reports/3460228 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1101 · Security Note
• https://ubuntu.com/security/CVE-2026-1101 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2026-1101 · Vendor Advisory
• https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04883 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-1101 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-1101 · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2042012545117004143 · Twitter Post
• https://twitter.com/CVEnew/status/2042010545742573786 · Twitter Post
• https://gitlab.com/gitlab-org/gitlab/-/work_items/586488 · Note