CVE-2026-1182: gitlab

CVSS: 4.3v3.1MediumAnalyzed

AliasesUBUNTU-CVE-2026-1182CGA-2fqc-xxx7-85jwCGA-2v6w-3hc8-h736+234 more

Published 12-03-2026Last modified 12-03-2026

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2026-1182 is a medium (CVSS 4.3) vulnerability in gitlab. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.4% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

27/100

0100

Medium · default modelHow is this calculated?

CVSS score

4.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.20%

0%100%

Low · +0.01 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 0 · Related 1

CGA-PJWJ-4JWX-72V3

Timeline

12-03-2026
PublishedVulnerability first disclosed.
12-03-2026
Last modifiedVulnerability information updated.

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.14 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to gain unauthorized access to confidential issue title created in public projects under certain circumstances.

CVSS metrics

5 scores · 5 sources · 1 version

v3.14.3

EPSS trend

Probability

0.20%

Chance of exploitation in the next 30 days

Percentile

Versus all other CVEs

30-day change

+0.01 pp

From 0.19% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.20%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (hackerone.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-212Improper Removal of Sensitive Information Before Storage or TransferThe product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.

Affected systems

Chainguard146 products

gitaly-config-18.7< 18.7.5-r0
gitaly-config-18.8< 18.8.5-r0
gitlab-agent-18.6< 18.6.6-r4
gitlab-agent-fips-18.6< 18.6.6-r2
gitlab-base-18.7< 18.7.5-r0

gitlab-base-18.8< 18.8.5-r0
gitlab-base-fips-18.7< 18.7.5-r0
gitlab-certificates-18.7< 18.7.5-r0
gitlab-certificates-18.8< 18.8.5-r0
gitlab-cfssl-self-sign-scripts-18.7< 18.7.5-r0
gitlab-cfssl-self-sign-scripts-18.8< 18.8.5-r0
gitlab-cng-18.7< 18.7.5-r0
gitlab-cng-18.8< 18.8.5-r0
gitlab-cng-fips-18.7< 18.7.5-r0
gitlab-cng-fips-18.8< 18.8.5-r0
gitlab-container-registry-18.7< 18.7.5-r0
gitlab-container-registry-18.8< 18.8.5-r0
gitlab-container-registry-fips-18.7< 18.7.5-r0
gitlab-container-registry-fips-18.8< 18.8.5-r0
gitlab-container-registry-scripts-18.7< 18.7.5-r0
gitlab-container-registry-scripts-18.8< 18.8.5-r0
gitlab-docker-machine-18.6< 18.6.6-r5
gitlab-docker-machine-18.7< 18.7.2-r8
gitlab-docker-machine-18.8< 18.8.0-r4
gitlab-docker-machine-18.9< 18.9.0-r3
gitlab-docker-machine-fips-18.7< 18.7.2-r7
gitlab-docker-machine-fips-18.8< 18.8.0-r5
gitlab-docker-machine-fips-18.9< 18.9.0-r3
gitlab-exporter-18.8< 18.8.5-r0
gitlab-exporter-scripts-18.7< 18.7.5-r0
gitlab-exporter-scripts-18.8< 18.8.5-r0
gitlab-gitaly-scripts-18.7< 18.7.5-r0
gitlab-gitaly-scripts-18.8< 18.8.5-r0
gitlab-kas-fips-18.6< 18.6.6-r2
gitlab-logger-18.7< 18.7.5-r0
gitlab-logger-18.8< 18.8.5-r0
gitlab-logger-fips-18.7< 18.7.5-r0
gitlab-logger-fips-18.8< 18.8.5-r0
gitlab-pages-scripts-18.7< 18.7.5-r0
gitlab-pages-scripts-18.8< 18.8.5-r0
gitlab-rails-ce-18.1< 18.1.6-r7
gitlab-rails-ce-18.2< 18.2.8-r3
gitlab-rails-ce-18.3< 18.3.6-r3
gitlab-rails-ce-18.4< 18.4.6-r1
gitlab-rails-ce-18.5< 18.5.5-r0
gitlab-rails-ce-assets-18.1< 18.1.6-r7
gitlab-rails-ce-assets-18.2< 18.2.8-r3
gitlab-rails-ce-assets-18.3< 18.3.6-r3
gitlab-rails-ce-assets-18.4< 18.4.6-r1
gitlab-rails-ce-assets-18.5< 18.5.5-r0
gitlab-rails-ce-assets-18.6< 18.6.6-r2
gitlab-rails-ce-assets-fips-18.1< 18.1.6-r7
gitlab-rails-ce-assets-fips-18.2< 18.2.8-r5
gitlab-rails-ce-assets-fips-18.4< 18.4.6-r3
gitlab-rails-ce-assets-fips-18.5< 18.5.5-r1
gitlab-rails-ce-assets-fips-18.6< 18.6.6-r2
gitlab-rails-ce-assets-fips-18.9< 18.9.1-r2
gitlab-rails-ce-doc-18.1< 18.1.6-r7
gitlab-rails-ce-doc-18.2< 18.2.8-r3
gitlab-rails-ce-doc-18.3< 18.3.6-r3
gitlab-rails-ce-doc-18.4< 18.4.6-r1
gitlab-rails-ce-doc-18.5< 18.5.5-r0
gitlab-rails-ce-doc-18.6< 18.6.6-r2
gitlab-rails-ce-doc-fips-18.1< 18.1.6-r7
gitlab-rails-ce-doc-fips-18.2< 18.2.8-r5
gitlab-rails-ce-doc-fips-18.3< 18.3.6-r4
gitlab-rails-ce-doc-fips-18.4< 18.4.6-r3
gitlab-rails-ce-doc-fips-18.5< 18.5.5-r1
gitlab-rails-ce-doc-fips-18.6< 18.6.6-r2
gitlab-rails-ce-doc-fips-18.9< 18.9.1-r2
gitlab-rails-ce-fips-18.1< 18.1.6-r7
gitlab-rails-ce-fips-18.2< 18.2.8-r5
gitlab-rails-ce-fips-18.3< 18.3.6-r4
gitlab-rails-ce-fips-18.4< 18.4.6-r3
gitlab-rails-ce-fips-18.5< 18.5.5-r1
gitlab-rails-ce-fips-18.6< 18.6.6-r2
gitlab-rails-ce-fips-18.9< 18.9.1-r2
gitlab-rails-scripts-18.7< 18.7.5-r0
gitlab-rails-scripts-18.8< 18.8.5-r0
gitlab-rails-scripts-fips-18.8< 18.8.5-r0
gitlab-runner-18.6< 18.6.6-r5
gitlab-runner-18.7< 18.7.2-r8
gitlab-runner-18.8< 18.8.0-r4
gitlab-runner-18.9< 18.9.0-r3
gitlab-runner-fips-18.7< 18.7.2-r7
gitlab-runner-fips-18.8< 18.8.0-r5
gitlab-runner-fips-18.9< 18.9.0-r3
gitlab-runner-helper-18.6< 18.6.6-r5
gitlab-runner-helper-18.7< 18.7.2-r8
gitlab-runner-helper-18.8< 18.8.0-r4
gitlab-runner-helper-18.9< 18.9.0-r3
gitlab-runner-helper-compat-18.6< 18.6.6-r5
gitlab-runner-helper-compat-18.7< 18.7.2-r8
gitlab-runner-helper-compat-18.8< 18.8.0-r4
gitlab-runner-helper-compat-18.9< 18.9.0-r3
gitlab-runner-helper-compat-fips-18.7< 18.7.2-r7
gitlab-runner-helper-compat-fips-18.8< 18.8.0-r5
gitlab-runner-helper-compat-fips-18.9< 18.9.0-r3
gitlab-runner-helper-fips-18.8< 18.8.0-r5
gitlab-runner-helper-fips-18.9< 18.9.0-r3
gitlab-runner-helper-oci-entrypoint-18.6< 18.6.6-r5
gitlab-runner-helper-oci-entrypoint-18.7< 18.7.2-r8
gitlab-runner-helper-oci-entrypoint-18.8< 18.8.0-r4
gitlab-runner-helper-oci-entrypoint-18.9< 18.9.0-r3
gitlab-runner-helper-oci-entrypoint-fips-18.7< 18.7.2-r7
gitlab-runner-helper-oci-entrypoint-fips-18.8< 18.8.0-r5
gitlab-runner-helper-oci-entrypoint-fips-18.9< 18.9.0-r3
gitlab-runner-oci-entrypoint-18.6< 18.6.6-r5
gitlab-runner-oci-entrypoint-18.7< 18.7.2-r8
gitlab-runner-oci-entrypoint-18.8< 18.8.0-r4
gitlab-runner-oci-entrypoint-18.9< 18.9.0-r3
gitlab-runner-oci-entrypoint-fips-18.7< 18.7.2-r7
gitlab-runner-oci-entrypoint-fips-18.8< 18.8.0-r5
gitlab-runner-oci-entrypoint-fips-18.9< 18.9.0-r3
gitlab-shell-18.7< 18.7.5-r0
gitlab-shell-18.8< 18.8.5-r0
gitlab-shell-fips-18.7< 18.7.5-r0
gitlab-shell-fips-18.8< 18.8.5-r0
gitlab-shell-scripts-18.7< 18.7.5-r0
gitlab-shell-scripts-18.8< 18.8.5-r0
gitlab-sidekiq-ce-18.7< 18.7.5-r0
gitlab-sidekiq-ce-18.8< 18.8.5-r0
gitlab-sidekiq-ce-fips-18.7< 18.7.5-r0
gitlab-sidekiq-ce-fips-18.8< 18.8.5-r0
gitlab-toolbox-ce-18.7< 18.7.5-r0
gitlab-toolbox-ce-18.8< 18.8.5-r0
gitlab-toolbox-ce-fips-18.7< 18.7.5-r0
gitlab-webservice-ce-18.7< 18.7.5-r0
gitlab-webservice-ce-18.8< 18.8.5-r0
gitlab-webservice-ce-fips-18.7< 18.7.5-r0
gitlab-webservice-ce-fips-18.8< 18.8.5-r0
gitlab-workhorse-ce-18.1< 18.1.6-r4
gitlab-workhorse-ce-18.2< 18.2.8-r5
gitlab-workhorse-ce-18.3< 18.3.6-r4
gitlab-workhorse-ce-18.4< 18.4.6-r1
gitlab-workhorse-ce-18.5< 18.5.5-r2
gitlab-workhorse-ce-18.6< 18.6.6-r1
gitlab-workhorse-ce-fips-18.1< 18.1.6-r5
gitlab-workhorse-ce-fips-18.2< 18.2.8-r4
gitlab-workhorse-ce-fips-18.3< 18.3.6-r4
gitlab-workhorse-ce-fips-18.4< 18.4.6-r1
gitlab-workhorse-ce-fips-18.5< 18.5.5-r1
gitlab-workhorse-scripts-18.7< 18.7.5-r0
gitlab-workhorse-scripts-18.8< 18.8.5-r0
gitlab-workhorse-scripts-fips-18.7< 18.7.5-r0
gitlab-workhorse-scripts-fips-18.8< 18.8.5-r0

Show all 146

Wolfi25 products

gitlab-agent-18.6< 18.6.6-r4
gitlab-docker-machine-18.6< 18.6.6-r5
gitlab-docker-machine-18.7< 18.7.2-r8
gitlab-docker-machine-18.8< 18.8.0-r4
gitlab-docker-machine-18.9< 18.9.0-r3

Show all 25

Gitlab1 product

gitlab≥ 8.14, < 18.7.6 | ≥ 18.8, < 18.8.6 | ≥ 18.9, < 18.9.2 | ≥ 8.14.0, < 18.7.6 | ≥ 18.8.0, < 18.8.6 | ≥ 18.9.0, < 18.9.2

Ubuntu1 product

gitlabAll versions (No fix recorded)

4 vendors · 173 products

References

6 links

gitlab.com/gitlab-org/gitlab/-/work_items/586613WEBBroken Link
hackerone.com/reports/3515716Technical DescriptionExploitPermissions RequiredREPORT
ubuntu.com/security/CVE-2026-1182REPORT
www.cve.org/CVERecord?id=CVE-2026-1182REPORT
github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1182.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-1182Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities