Is CVE-2026-100755 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100755 being exploited in the wild.

How severe is CVE-2026-100755?

Medium severity, with a CVSS score of 4.6, published 13 October 2026.

Which products and versions are affected?

GitLab CE 16.2 to 19.2.7, 19.3.0 to 19.3.4, 19.4.0 to 19.4.1; GitLab EE 16.2 to 19.2.7, 19.3.0 to 19.3.4, 19.4.0 to 19.4.1.

Is there a fix for CVE-2026-100755?

Yes: fixed in GitLab CE/EE 19.2.8, 19.3.5, 19.4.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100755 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-100755?

Check whether you run GitLab, GitLab CE or GitLab EE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100755: GitLab CE/EE page cache poisoning via improper cache key construction

CVE-2026-100755 · Severity: medium · CVSS 4.6 · Published 2026-10-13

GitLab is a platform for managing code repositories and CI/CD pipelines used by development teams. A vulnerability in certain GitLab deployments could allow an authenticated user to poison cached pages seen by other users, potentially injecting malicious content into merge requests and other shared views. This could lead to account compromise, credential theft, or malware distribution among development team members.

Technologies: GitLab, GitLab CE, GitLab EE. Vendors: GitLab.

Quick answers

Is CVE-2026-100755 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100755 being exploited in the wild.
How severe is CVE-2026-100755?: Medium severity, with a CVSS score of 4.6, published 13 October 2026.
Which products and versions are affected?: GitLab CE 16.2 to 19.2.7, 19.3.0 to 19.3.4, 19.4.0 to 19.4.1; GitLab EE 16.2 to 19.2.7, 19.3.0 to 19.3.4, 19.4.0 to 19.4.1.
Is there a fix for CVE-2026-100755?: Yes: fixed in GitLab CE/EE 19.2.8, 19.3.5, 19.4.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100755 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-100755?: Check whether you run GitLab, GitLab CE or GitLab EE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: GitLab CE/EE 19.2.8, 19.3.5, 19.4.2

Technical details

The vulnerability is a page cache poisoning issue caused by improper cache key construction in merge request handling. It requires authentication and affects GitLab instances under specific deployment configurations. An authenticated attacker can craft requests that poison the page cache, causing malicious content to be served to other users. The issue has been remediated in GitLab 19.2.8, 19.3.5, and 19.4.2.

Affected products

GitLab GitLab CE 16.2 to 19.2.7, 19.3.0 to 19.3.4, 19.4.0 to 19.4.1
GitLab GitLab EE 16.2 to 19.2.7, 19.3.0 to 19.3.4, 19.4.0 to 19.4.1

Timeline

2026-10-12: advisory
2026-10-12: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.