CVE-2026-2370 - Vulnerability Analysis

Overview

GitLab CE/EE >= 14.3 and < 18.8.7, 18.9 < 18.9.3, and 18.10 < 18.10.1 contains a broken access control caused by improper authorization checks in Jira Connect installations, letting authenticated users with minimal workspace permissions obtain installation credentials and impersonate the GitLab app.

Severity & Score

Impact

Authenticated users with minimal permissions can obtain credentials and impersonate the GitLab app, risking unauthorized actions and data access.

Mitigation

Update to GitLab CE/EE 18.8.7, 18.9.3, 18.10.1 or later.

References

• https://hackerone.com/reports/3522829
• https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/
• https://gitlab.com/gitlab-org/gitlab/-/work_items/589635

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner