← Back

CVE-2026-12635

nvd nist
Published: Jun 25, 2026Modified: Jun 26, 2026

JSON object

Loading...
3.1
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 1.6 / Impact: 1.4
Source: NVD

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to make requests to internal network resources through mirror synchronization due to improper URL validation.

Affected (3)

Products: Gitlab: Gitlab
Gitlab
1 product
Gitlab
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Gitlab
Gitlab
From 19.0.0 to 19.0.3
Gitlab
From 8.3.0 to 18.11.6
Gitlab
Version 19.1.0

Related CWEs

CWE-350
Reliance on Reverse DNS Resolution for a Security-Critical Action
The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.

References (2)

Source: cve@gitlab.com
Release NotesVendor Advisory
Source: cve@gitlab.com
Broken Link

Timeline

No history available yet.