CVE catalog

CVE-2026-2370

GitLab has remediated an issue in GitLab CE/EE…

[CVE catalog]

A flaw was found in GitLab CE/EE. An authenticated user with minimal workspace permissions could exploit an improper authorization check within Jira Connect installations to obtain installation credentials and impersonate the GitLab application. This vulnerability could lead to unauthorized access and control over the GitLab app. GitLab: GitLab: Improper authorization allows credential disclosure and GitLab app impersonation The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.45% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Ubuntu16.04gitlab8.4.3+dfsg-12UnknownSource applicability is not established[UBUNTU-CVE-2026-2370]
Ubuntu16.04gitlab8.4.3+dfsg-9UnknownSource applicability is not established[UBUNTU-CVE-2026-2370]
Ubuntu16.04gitlab8.5.8+dfsg-5UnknownSource applicability is not established[UBUNTU-CVE-2026-2370]
UnknownRelease not reportedgitlabNot reportedUnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedgitlab18.8.7UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedgitlab18.9.3UnknownSource applicability is not establishedProvider not reported
Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedgitlabNot reportedUnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedgitlab18.8.7UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedgitlab18.9.3UnknownSource applicability is not establishedProvider not reported
Ubuntu16.04gitlab8.4.3+dfsg-12UnknownSource applicability is not established[UBUNTU-CVE-2026-2370]
Ubuntu16.04gitlab8.4.3+dfsg-9UnknownSource applicability is not established[UBUNTU-CVE-2026-2370]
Ubuntu16.04gitlab8.5.8+dfsg-5UnknownSource applicability is not established[UBUNTU-CVE-2026-2370]
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "gitlab",
      "fixed_version": "18.8.7",
      "applicability_unknown": true
    },
    {
      "name": "gitlab",
      "fixed_version": "18.9.3",
      "applicability_unknown": true
    },
    {
      "name": "gitlab",
      "fixed_version": "",
      "applicability_unknown": true
    },
    {
      "name": "gitlab",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "8.4.3+dfsg-9",
        "8.4.3+dfsg-12",
        "8.5.8+dfsg-5"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-2370",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-2370",
      "provider_updated_at": "2026-06-30T18:17:37.637780368Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]