Is CVE-2026-7767 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-7767 being exploited in the wild.

How severe is CVE-2026-7767?

Medium severity, with a CVSS score of 5.8, published 13 October 2026.

Which products and versions are affected?

GitLab CE 13.11 to 19.2.7, 19.3.0 to 19.3.4, 19.4.0 to 19.4.1; GitLab EE 13.11 to 19.2.7, 19.3.0 to 19.3.4, 19.4.0 to 19.4.1.

Is there a fix for CVE-2026-7767?

Yes: fixed in GitLab CE/EE 19.2.8, 19.3.5, 19.4.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-7767 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-7767?

Check whether you run GitLab, GitLab CE or GitLab EE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7767: GitLab open redirect in Kubernetes proxy

CVE-2026-7767 · Severity: medium · CVSS 5.8 · Published 2026-10-13

GitLab is a web-based platform for version control and CI/CD that many organizations use to manage their code and deployments. A vulnerability in GitLab's Kubernetes integration could allow an authenticated user who controls a Kubernetes agent to redirect authentication tokens to an unintended server through an open redirect flaw, potentially exposing sensitive credentials to attackers.

Technologies: GitLab, GitLab CE, GitLab EE. Vendors: GitLab.

Quick answers

Is CVE-2026-7767 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-7767 being exploited in the wild.
How severe is CVE-2026-7767?: Medium severity, with a CVSS score of 5.8, published 13 October 2026.
Which products and versions are affected?: GitLab CE 13.11 to 19.2.7, 19.3.0 to 19.3.4, 19.4.0 to 19.4.1; GitLab EE 13.11 to 19.2.7, 19.3.0 to 19.3.4, 19.4.0 to 19.4.1.
Is there a fix for CVE-2026-7767?: Yes: fixed in GitLab CE/EE 19.2.8, 19.3.5, 19.4.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7767 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-7767?: Check whether you run GitLab, GitLab CE or GitLab EE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: GitLab CE/EE 19.2.8, 19.3.5, 19.4.2

Technical details

An open redirect vulnerability exists in GitLab's Kubernetes proxy due to improper redirect validation. An authenticated user controlling a Kubernetes agent can exploit this to redirect sensitive authentication tokens to an attacker-controlled server. The vulnerability affects multiple version lines and requires both authentication and control of a Kubernetes agent.

Affected products

GitLab GitLab CE 13.11 to 19.2.7, 19.3.0 to 19.3.4, 19.4.0 to 19.4.1
GitLab GitLab EE 13.11 to 19.2.7, 19.3.0 to 19.3.4, 19.4.0 to 19.4.1

Timeline

2026-10-13: disclosed
2026-10-12: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.