Executive brief
GitLab has fixed a security flaw that allowed users with 'Developer' permissions to delete protected container registry tags. These tags are typically used to safeguard specific versions of software images from accidental or unauthorized removal. An exploit could lead to the loss of critical build artifacts or deployment images, potentially disrupting software delivery pipelines.
Technical details
An authorization bypass vulnerability (CWE-639) exists in GitLab CE/EE's container registry component. The issue stems from improper authorization checks when processing deletion requests for registry tags. An authenticated attacker with at least Developer-level permissions can bypass protections intended to restrict the deletion of specific tags. This allows for the unauthorized removal of protected container images via the network without user interaction. The vulnerability is remediated in versions 18.9.7, 18.10.6, and 18.11.3.
Affected products
- GitLab GitLab Community Edition (CE) 17.10 to <18.9.7, 18.10 to <18.10.6, 18.11 to <18.11.3
- GitLab GitLab Enterprise Edition (EE) 17.10 to <18.9.7, 18.10 to <18.10.6, 18.11 to <18.11.3
Timeline
- 2026-05-13: patched: GitLab released versions 18.9.7, 18.10.6, and 18.11.3 to address the issue.
- 2026-05-14: disclosed: CVE-2026-1338 was published.