CVE-2026-6267: gitlab

CVSS: 8.5v3.1HighAnalyzed

AliasesCGA-222c-33x7-8fv9CGA-35r3-c2p6-j877CGA-37vh-phxq-37gq+240 more

Published 29-07-2026Last modified 31-07-2026

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2026-6267 is a high (CVSS 8.5) vulnerability in gitlab. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48.6% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

44/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.61%

0%100%

Low · +0.19 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 0 · Related 1

CGA-798X-XPPR-CXP6

Timeline

29-07-2026
PublishedVulnerability first disclosed.
31-07-2026
Last modifiedVulnerability information updated.

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access controls on internal request handling.

CVSS metrics

4 scores · 4 sources · 1 version

v3.18.5

EPSS trend

Probability

0.61%

Chance of exploitation in the next 30 days

Percentile

49%

Versus all other CVEs

30-day change

+0.19 pp

From 0.42% on 21-09-2026

21-09-202621-10-2026

EPSS score

0.61%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (hackerone.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-201Insertion of Sensitive Information Into Sent DataThe code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Affected systems

Chainguard122 products

gitaly-config-18.11< 18.11.7-r0
gitlab-base-18.11< 18.11.7-r0
gitlab-base-fips-18.11< 18.11.7-r5
gitlab-certificates-18.11< 18.11.7-r0
gitlab-cfssl-self-sign-scripts-18.11< 18.11.7-r0

gitlab-cng-18.11< 18.11.7-r0
gitlab-cng-fips-18.11< 18.11.7-r5
gitlab-container-registry-18.11< 18.11.7-r0
gitlab-container-registry-fips-18.11< 18.11.7-r5
gitlab-container-registry-scripts-18.11< 18.11.7-r0
gitlab-docker-machine-18.11< 18.11.4-r2
gitlab-docker-machine-19.0< 19.0.3-r0
gitlab-docker-machine-19.1< 19.1.2-r1
gitlab-docker-machine-fips-18.11< 18.11.4-r4
gitlab-docker-machine-fips-19.0< 19.0.3-r0
gitlab-docker-machine-fips-19.1< 19.1.2-r0
gitlab-exporter-18.11< 18.11.7-r0
gitlab-exporter-scripts-18.11< 18.11.7-r0
gitlab-gitaly-scripts-18.11< 18.11.7-r0
gitlab-logger-18.11< 18.11.7-r0
gitlab-logger-fips-18.11< 18.11.7-r5
gitlab-pages-scripts-18.11< 18.11.7-r0
gitlab-rails-ce-18.1< 18.1.6-r26
gitlab-rails-ce-18.10< 18.10.8-r6
gitlab-rails-ce-18.11< 18.11.7-r0
gitlab-rails-ce-18.6< 18.6.8-r5
gitlab-rails-ce-18.7< 18.7.7-r4
gitlab-rails-ce-18.8< 18.8.11-r4
gitlab-rails-ce-18.9< 18.9.8-r7
gitlab-rails-ce-assets-18.1< 18.1.6-r26
gitlab-rails-ce-assets-18.10< 18.10.8-r6
gitlab-rails-ce-assets-18.11< 18.11.7-r0
gitlab-rails-ce-assets-18.6< 18.6.8-r5
gitlab-rails-ce-assets-18.7< 18.7.7-r4
gitlab-rails-ce-assets-18.8< 18.8.11-r4
gitlab-rails-ce-assets-18.9< 18.9.8-r7
gitlab-rails-ce-assets-fips-18.1< 18.1.6-r80
gitlab-rails-ce-assets-fips-18.10< 18.10.8-r7
gitlab-rails-ce-assets-fips-18.11< 18.11.7-r5
gitlab-rails-ce-assets-fips-18.6< 18.6.8-r5
gitlab-rails-ce-assets-fips-18.7< 18.7.7-r4
gitlab-rails-ce-assets-fips-18.8< 18.8.11-r4
gitlab-rails-ce-assets-fips-18.9< 18.9.8-r4
gitlab-rails-ce-assets-fips-19.0< 19.0.5-r0
gitlab-rails-ce-doc-18.1< 18.1.6-r26
gitlab-rails-ce-doc-18.10< 18.10.8-r6
gitlab-rails-ce-doc-18.11< 18.11.7-r0
gitlab-rails-ce-doc-18.6< 18.6.8-r5
gitlab-rails-ce-doc-18.7< 18.7.7-r4
gitlab-rails-ce-doc-18.8< 18.8.11-r4
gitlab-rails-ce-doc-18.9< 18.9.8-r7
gitlab-rails-ce-doc-fips-18.1< 18.1.6-r80
gitlab-rails-ce-doc-fips-18.10< 18.10.8-r7
gitlab-rails-ce-doc-fips-18.11< 18.11.7-r5
gitlab-rails-ce-doc-fips-18.6< 18.6.8-r5
gitlab-rails-ce-doc-fips-18.7< 18.7.7-r4
gitlab-rails-ce-doc-fips-18.8< 18.8.11-r4
gitlab-rails-ce-doc-fips-18.9< 18.9.8-r4
gitlab-rails-ce-doc-fips-19.0< 19.0.5-r0
gitlab-rails-ce-fips-18.1< 18.1.6-r80
gitlab-rails-ce-fips-18.10< 18.10.8-r7
gitlab-rails-ce-fips-18.11< 18.11.7-r5
gitlab-rails-ce-fips-18.6< 18.6.8-r5
gitlab-rails-ce-fips-18.7< 18.7.7-r4
gitlab-rails-ce-fips-18.8< 18.8.11-r4
gitlab-rails-ce-fips-18.9< 18.9.8-r4
gitlab-rails-ce-fips-19.0< 19.0.5-r0
gitlab-rails-scripts-18.11< 18.11.7-r0
gitlab-rails-scripts-fips-18.11< 18.11.7-r5
gitlab-runner-18.11< 18.11.4-r2
gitlab-runner-19.0< 19.0.3-r0
gitlab-runner-19.1< 19.1.2-r1
gitlab-runner-fips-18.11< 18.11.4-r4
gitlab-runner-fips-19.0< 19.0.3-r0
gitlab-runner-fips-19.1< 19.1.2-r0
gitlab-runner-helper-18.11< 18.11.4-r2
gitlab-runner-helper-19.0< 19.0.3-r0
gitlab-runner-helper-19.1< 19.1.2-r1
gitlab-runner-helper-compat-18.11< 18.11.4-r2
gitlab-runner-helper-compat-19.0< 19.0.3-r0
gitlab-runner-helper-compat-19.1< 19.1.2-r1
gitlab-runner-helper-compat-fips-18.11< 18.11.4-r4
gitlab-runner-helper-compat-fips-19.0< 19.0.3-r0
gitlab-runner-helper-compat-fips-19.1< 19.1.2-r0
gitlab-runner-helper-fips-18.11< 18.11.4-r4
gitlab-runner-helper-fips-19.0< 19.0.3-r0
gitlab-runner-helper-fips-19.1< 19.1.2-r0
gitlab-runner-helper-oci-entrypoint-18.11< 18.11.4-r2
gitlab-runner-helper-oci-entrypoint-19.0< 19.0.3-r0
gitlab-runner-helper-oci-entrypoint-19.1< 19.1.2-r1
gitlab-runner-helper-oci-entrypoint-fips-18.11< 18.11.4-r4
gitlab-runner-helper-oci-entrypoint-fips-19.0< 19.0.3-r0
gitlab-runner-helper-oci-entrypoint-fips-19.1< 19.1.2-r0
gitlab-runner-oci-entrypoint-18.11< 18.11.4-r2
gitlab-runner-oci-entrypoint-19.0< 19.0.3-r0
gitlab-runner-oci-entrypoint-19.1< 19.1.2-r1
gitlab-runner-oci-entrypoint-fips-18.11< 18.11.4-r4
gitlab-runner-oci-entrypoint-fips-19.0< 19.0.3-r0
gitlab-runner-oci-entrypoint-fips-19.1< 19.1.2-r0
gitlab-shell-18.11< 18.11.7-r0
gitlab-shell-fips-18.11< 18.11.7-r5
gitlab-shell-scripts-18.11< 18.11.7-r0
gitlab-sidekiq-ce-18.11< 18.11.7-r0
gitlab-sidekiq-ce-fips-18.11< 18.11.7-r5
gitlab-toolbox-ce-18.11< 18.11.7-r0
gitlab-toolbox-ce-fips-18.11< 18.11.7-r5
gitlab-webservice-ce-18.11< 18.11.7-r0
gitlab-webservice-ce-fips-18.11< 18.11.7-r5
gitlab-workhorse-ce-18.10< 18.10.8-r3
gitlab-workhorse-ce-18.11< 18.11.8-r0
gitlab-workhorse-ce-18.6< 18.6.8-r4
gitlab-workhorse-ce-18.7< 18.7.7-r4
gitlab-workhorse-ce-18.8< 18.8.11-r2
gitlab-workhorse-ce-18.9< 18.9.8-r5
gitlab-workhorse-ce-fips-18.10< 18.10.8-r4
gitlab-workhorse-ce-fips-18.11< 18.11.8-r1
gitlab-workhorse-ce-fips-18.6< 18.6.8-r6
gitlab-workhorse-ce-fips-18.7< 18.7.7-r5
gitlab-workhorse-ce-fips-18.8< 18.8.11-r4
gitlab-workhorse-ce-fips-18.9< 18.9.8-r5
gitlab-workhorse-scripts-18.11< 18.11.7-r0
gitlab-workhorse-scripts-fips-18.11< 18.11.7-r5

Show all 122

Wolfi18 products

gitlab-docker-machine-18.11< 18.11.4-r2
gitlab-docker-machine-19.0< 19.0.3-r0
gitlab-docker-machine-19.1< 19.1.2-r1
gitlab-runner-18.11< 18.11.4-r2
gitlab-runner-19.0< 19.0.3-r0

Show all 18

Gitlab1 product

gitlabEOL≥ 19.1, < 19.1.3 | ≥ 19.2, < 19.2.1 | ≥ 10.1.0, < 19.0.5 | ≥ 19.1.0, < 19.1.3 | 19.2.0

3 vendors · 141 products

References

5 links

gitlab.com/gitlab-org/gitlab/-/work_items/596606WEBBroken Link
hackerone.com/reports/3658324Technical DescriptionExploitPermissions RequiredREPORT
docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/WEBRelease NotesVendor Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6267.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-6267Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities