Executive brief
GitLab is a platform used by organizations to manage software development and source code. A security flaw in the repository import feature could allow a logged-in user to bypass security controls and access sensitive files on the server or reach internal network resources that should be private. This could lead to the exposure of proprietary code or internal configuration data.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in GitLab CE/EE due to insufficient validation of secondary URLs during the repository import process. An authenticated attacker with network access can exploit this by providing specially crafted URLs, which the Gitaly server fails to properly sanitize. Successful exploitation allows the attacker to read arbitrary files from the Gitaly server's filesystem or interact with internal network services that are otherwise unreachable from the public internet. The vulnerability is mitigated by a high attack complexity, requiring specific conditions to be met during the import process. Patches have been released in versions 18.10.8, 18.11.5, and 19.0.2.
Affected products
- GitLab GitLab Community Edition (CE) / Enterprise Edition (EE) 18.10 to < 18.10.8, 18.11 to < 18.11.5, 19.0 to < 19.0.2
Timeline
- 2026-06-10: patched: GitLab released versions 18.10.8, 18.11.5, and 19.0.2 to address the issue.
- 2026-06-11: disclosed: Public disclosure of CVE-2026-9204.