ZeroDay Findings
Sign inSign up

Findings

CVE-2026-7767

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could hav

Published Oct 12, 2026 · updated Oct 14, 2026 · GitLab GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tok

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 13, 2026 · NIST NVD

    Detected

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to an unintended server due to improper redirect validation in the Kubernetes proxy.

  2. Oct 14, 2026 · NIST NVD

    Updated

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to an unintended server due to improper redirect validation in the Kubernetes proxy.

  3. Oct 14, 2026 · NIST NVD

    Updated

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to an unintended server due to improper redirect validation in the Kubernetes proxy.

Affected

  • cpe gitlab/gitlabversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-7767

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-7767

    30-day exploitation probability 0.2%

    first.org
  • GitLab Security ReleasesVendor advisoryCVE-2026-7767

    On October 12, 2026, we released versions 19.4.2, 19.3.5, 19.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). 19.3.4 had a bug that affected merge request pages when the Ona integration was enabled. This is fixed in 19.3.5. These versions contain important bug a

    docs.gitlab.com
  • NIST NVDVulnerability recordCVE-2026-7767

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tok

    nvd.nist.gov

References