CVE-2026-1402: gitlab

CVSS: 6.5v3.1MediumAnalyzed

AliasesUBUNTU-CVE-2026-1402CGA-2393-3vvm-g3jpCGA-26g2-264c-85cg+312 more

Published 27-05-2026Last modified 27-05-2026

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2026-1402 is a medium (CVSS 6.5) vulnerability in gitlab. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.4% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

36/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.47%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 0 · Related 1

CGA-8MR3-JXRJ-55XW

Timeline

27-05-2026
PublishedVulnerability first disclosed.
27-05-2026
Last modifiedVulnerability information updated.

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an authenticated user to cause denial of service due to insufficient validation.

CVSS metrics

5 scores · 5 sources · 1 version

v3.16.5

EPSS trend

Probability

0.47%

Chance of exploitation in the next 30 days

Percentile

39%

Versus all other CVEs

30-day change

0.00 pp

From 0.47% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.47%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (hackerone.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Chainguard158 products

gitaly-config-19.0< 19.0.2-r0
gitlab-agent-18.6All versions (No fix recorded)
gitlab-agent-18.7All versions (No fix recorded)
gitlab-agent-18.8All versions (No fix recorded)
gitlab-agent-18.9All versions (No fix recorded)

gitlab-base-19.0< 19.0.2-r0
gitlab-base-fips-19.0< 19.0.2-r0
gitlab-certificates-19.0< 19.0.2-r0
gitlab-cfssl-self-sign-scripts-19.0< 19.0.2-r0
gitlab-cng-19.0< 19.0.2-r0
gitlab-cng-fips-19.0< 19.0.2-r0
gitlab-container-registry-19.0< 19.0.2-r0
gitlab-container-registry-fips-19.0< 19.0.2-r0
gitlab-container-registry-scripts-19.0< 19.0.2-r0
gitlab-docker-machine-18.10All versions (No fix recorded)
gitlab-docker-machine-18.11< 18.11.4-r0
gitlab-docker-machine-18.6All versions (No fix recorded)
gitlab-docker-machine-18.7All versions (No fix recorded)
gitlab-docker-machine-18.8All versions (No fix recorded)
gitlab-docker-machine-18.9All versions (No fix recorded)
gitlab-docker-machine-19.0< 19.0.1-r0
gitlab-docker-machine-fips-18.10All versions (No fix recorded)
gitlab-docker-machine-fips-18.11< 18.11.4-r0
gitlab-docker-machine-fips-19.0< 19.0.1-r0
gitlab-exporter-19.0< 19.0.2-r0
gitlab-exporter-scripts-19.0< 19.0.2-r0
gitlab-gitaly-scripts-19.0< 19.0.2-r0
gitlab-kas-18.6All versions (No fix recorded)
gitlab-kas-18.7All versions (No fix recorded)
gitlab-kas-18.8All versions (No fix recorded)
gitlab-kas-18.9All versions (No fix recorded)
gitlab-logger-19.0< 19.0.2-r0
gitlab-logger-fips-19.0< 19.0.2-r0
gitlab-pages-18.6All versions (No fix recorded)
gitlab-pages-18.7All versions (No fix recorded)
gitlab-pages-18.8All versions (No fix recorded)
gitlab-pages-18.9All versions (No fix recorded)
gitlab-pages-scripts-19.0< 19.0.2-r0
gitlab-rails-ce-18.1All versions (No fix recorded)
gitlab-rails-ce-18.4All versions (No fix recorded)
gitlab-rails-ce-18.5All versions (No fix recorded)
gitlab-rails-ce-18.6All versions (No fix recorded)
gitlab-rails-ce-18.7All versions (No fix recorded)
gitlab-rails-ce-18.8All versions (No fix recorded)
gitlab-rails-ce-18.9All versions (No fix recorded)
gitlab-rails-ce-assets-18.1All versions (No fix recorded)
gitlab-rails-ce-assets-18.4All versions (No fix recorded)
gitlab-rails-ce-assets-18.5All versions (No fix recorded)
gitlab-rails-ce-assets-18.6All versions (No fix recorded)
gitlab-rails-ce-assets-18.7All versions (No fix recorded)
gitlab-rails-ce-assets-18.8All versions (No fix recorded)
gitlab-rails-ce-assets-18.9All versions (No fix recorded)
gitlab-rails-ce-assets-19.0< 19.0.1-r0
gitlab-rails-ce-assets-fips-18.1All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.4All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.5All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.6All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.7All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.8All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.9All versions (No fix recorded)
gitlab-rails-ce-doc-18.1All versions (No fix recorded)
gitlab-rails-ce-doc-18.4All versions (No fix recorded)
gitlab-rails-ce-doc-18.5All versions (No fix recorded)
gitlab-rails-ce-doc-18.6All versions (No fix recorded)
gitlab-rails-ce-doc-18.7All versions (No fix recorded)
gitlab-rails-ce-doc-18.8All versions (No fix recorded)
gitlab-rails-ce-doc-18.9All versions (No fix recorded)
gitlab-rails-ce-doc-19.0< 19.0.1-r0
gitlab-rails-ce-doc-fips-18.1All versions (No fix recorded)
gitlab-rails-ce-doc-fips-18.4All versions (No fix recorded)
gitlab-rails-ce-doc-fips-18.5All versions (No fix recorded)
gitlab-rails-ce-doc-fips-18.6All versions (No fix recorded)
gitlab-rails-ce-doc-fips-18.7All versions (No fix recorded)
gitlab-rails-ce-doc-fips-18.8All versions (No fix recorded)
gitlab-rails-ce-doc-fips-18.9All versions (No fix recorded)
gitlab-rails-ce-fips-18.1All versions (No fix recorded)
gitlab-rails-ce-fips-18.4All versions (No fix recorded)
gitlab-rails-ce-fips-18.5All versions (No fix recorded)
gitlab-rails-ce-fips-18.6All versions (No fix recorded)
gitlab-rails-ce-fips-18.7All versions (No fix recorded)
gitlab-rails-ce-fips-18.8All versions (No fix recorded)
gitlab-rails-ce-fips-18.9All versions (No fix recorded)
gitlab-rails-ce-fips-19.0< 19.0.1-r0
gitlab-rails-scripts-19.0< 19.0.2-r0
gitlab-rails-scripts-fips-19.0< 19.0.2-r0
gitlab-runner-18.10All versions (No fix recorded)
gitlab-runner-18.11< 18.11.4-r0
gitlab-runner-18.6All versions (No fix recorded)
gitlab-runner-18.7All versions (No fix recorded)
gitlab-runner-18.8All versions (No fix recorded)
gitlab-runner-18.9All versions (No fix recorded)
gitlab-runner-19.0< 19.0.1-r0
gitlab-runner-fips-18.10All versions (No fix recorded)
gitlab-runner-fips-18.11< 18.11.4-r0
gitlab-runner-fips-19.0< 19.0.1-r0
gitlab-runner-helper-18.10All versions (No fix recorded)
gitlab-runner-helper-18.11< 18.11.4-r0
gitlab-runner-helper-18.6All versions (No fix recorded)
gitlab-runner-helper-18.7All versions (No fix recorded)
gitlab-runner-helper-18.8All versions (No fix recorded)
gitlab-runner-helper-18.9All versions (No fix recorded)
gitlab-runner-helper-19.0< 19.0.1-r0
gitlab-runner-helper-compat-18.10All versions (No fix recorded)
gitlab-runner-helper-compat-18.11< 18.11.4-r0
gitlab-runner-helper-compat-18.6All versions (No fix recorded)
gitlab-runner-helper-compat-18.7All versions (No fix recorded)
gitlab-runner-helper-compat-18.8All versions (No fix recorded)
gitlab-runner-helper-compat-18.9All versions (No fix recorded)
gitlab-runner-helper-compat-19.0< 19.0.1-r0
gitlab-runner-helper-compat-fips-18.10All versions (No fix recorded)
gitlab-runner-helper-compat-fips-18.11< 18.11.4-r0
gitlab-runner-helper-compat-fips-19.0< 19.0.1-r0
gitlab-runner-helper-fips-18.10All versions (No fix recorded)
gitlab-runner-helper-fips-18.11< 18.11.4-r0
gitlab-runner-helper-fips-19.0< 19.0.1-r0
gitlab-runner-helper-oci-entrypoint-18.10All versions (No fix recorded)
gitlab-runner-helper-oci-entrypoint-18.11< 18.11.4-r0
gitlab-runner-helper-oci-entrypoint-18.6All versions (No fix recorded)
gitlab-runner-helper-oci-entrypoint-18.7All versions (No fix recorded)
gitlab-runner-helper-oci-entrypoint-18.8All versions (No fix recorded)
gitlab-runner-helper-oci-entrypoint-18.9All versions (No fix recorded)
gitlab-runner-helper-oci-entrypoint-19.0< 19.0.1-r0
gitlab-runner-helper-oci-entrypoint-fips-18.10All versions (No fix recorded)
gitlab-runner-helper-oci-entrypoint-fips-18.11< 18.11.4-r0
gitlab-runner-helper-oci-entrypoint-fips-19.0< 19.0.1-r0
gitlab-runner-oci-entrypoint-18.10All versions (No fix recorded)
gitlab-runner-oci-entrypoint-18.11< 18.11.4-r0
gitlab-runner-oci-entrypoint-18.6All versions (No fix recorded)
gitlab-runner-oci-entrypoint-18.7All versions (No fix recorded)
gitlab-runner-oci-entrypoint-18.8All versions (No fix recorded)
gitlab-runner-oci-entrypoint-18.9All versions (No fix recorded)
gitlab-runner-oci-entrypoint-19.0< 19.0.1-r0
gitlab-runner-oci-entrypoint-fips-18.10All versions (No fix recorded)
gitlab-runner-oci-entrypoint-fips-18.11< 18.11.4-r0
gitlab-runner-oci-entrypoint-fips-19.0< 19.0.1-r0
gitlab-shell-19.0< 19.0.2-r0
gitlab-shell-fips-19.0< 19.0.2-r0
gitlab-shell-scripts-19.0< 19.0.2-r0
gitlab-sidekiq-ce-19.0< 19.0.2-r0
gitlab-sidekiq-ce-fips-19.0< 19.0.2-r0
gitlab-toolbox-ce-19.0< 19.0.2-r0
gitlab-toolbox-ce-fips-19.0< 19.0.2-r0
gitlab-webservice-ce-19.0< 19.0.2-r0
gitlab-webservice-ce-fips-19.0< 19.0.2-r0
gitlab-workhorse-ce-18.4All versions (No fix recorded)
gitlab-workhorse-ce-18.5All versions (No fix recorded)
gitlab-workhorse-ce-18.6All versions (No fix recorded)
gitlab-workhorse-ce-18.7All versions (No fix recorded)
gitlab-workhorse-ce-18.8All versions (No fix recorded)
gitlab-workhorse-ce-18.9All versions (No fix recorded)
gitlab-workhorse-ce-fips-18.4All versions (No fix recorded)
gitlab-workhorse-ce-fips-18.5All versions (No fix recorded)
gitlab-workhorse-ce-fips-18.6All versions (No fix recorded)
gitlab-workhorse-ce-fips-18.7All versions (No fix recorded)
gitlab-workhorse-ce-fips-18.8All versions (No fix recorded)
gitlab-workhorse-ce-fips-18.9All versions (No fix recorded)
gitlab-workhorse-scripts-19.0< 19.0.2-r0
gitlab-workhorse-scripts-fips-19.0< 19.0.2-r0

Show all 158

Wolfi42 products

gitlab-agent-18.6All versions (No fix recorded)
gitlab-agent-18.7All versions (No fix recorded)
gitlab-agent-18.8All versions (No fix recorded)
gitlab-agent-18.9All versions (No fix recorded)
gitlab-docker-machine-18.10All versions (No fix recorded)

Show all 42

2 vendors · 200 products · Showing 200 of 214. Use Open JSON for the complete list.

References

7 links

hackerone.com/reports/3517283Technical DescriptionExploitPermissions RequiredREPORT
gitlab.com/gitlab-org/gitlab/-/work_items/587569REPORTWEBBroken Link
about.gitlab.com/releases/2026/05/27/patch-release-gitlab-19-0-1-released/REPORTWEBRelease Notes
ubuntu.com/security/CVE-2026-1402REPORT
www.cve.org/CVERecord?id=CVE-2026-1402REPORT
github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1402.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-1402Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities