GitLab flaws being used in attacks

CISA lists 5 flaws in GitLab products as being used in attacks, most recently on 11 Sep 2026. 1 has been used in ransomware.

What to do

1. Update every GitLab product you use.Install the updates GitLab offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
2. If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
3. Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.

Every flaw, newest first

1. Being used in attacksAdded by CISA on 11 Sep 2026
   GitLab Community Edition and Enterprise Edition
   CVE-2026-85706GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
   GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.
   CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all

   Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
   CVE recordNVD
2. Being used in attacksAdded by CISA on 18 Feb 2026
   GitLab
   CVE-2021-22175GitLab Server-Side Request Forgery (SSRF) Vulnerability
   GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
3. Being used in attacksAdded by CISA on 3 Feb 2026
   GitLab Community and Enterprise Editions
   CVE-2021-39935GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability
   GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
4. Being used in attacksAdded by CISA on 1 May 2024
   GitLab CE/EE
   CVE-2023-7028GitLab Community and Enterprise Editions Improper Access Control Vulnerability
   GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.
   CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
5. Being used in attacksUsed in ransomwareAdded by CISA on 3 Nov 2021
   GitLab Community and Enterprise Editions
   CVE-2021-22205GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
   GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD

From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. GitLab on CISA’s site.