CVE-2026-2370 - Vulnerability Analysis

Overview

GitLab CE/EE >= 14.3 and < 18.8.7, 18.9 < 18.9.3, and 18.10 < 18.10.1 contains a broken access control caused by improper authorization checks in Jira Connect installations, letting authenticated users with minimal workspace permissions obtain installation credentials and impersonate the GitLab app.

Severity & Score

Impact

Authenticated users with minimal permissions can obtain credentials and impersonate the GitLab app, risking unauthorized actions and data access.

Mitigation

Update to GitLab CE/EE 18.8.7, 18.9.3, 18.10.1 or later.

References

• https://gitlab.com/gitlab-org/gitlab/-/work_items/589635
• https://hackerone.com/reports/3522829
• https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 30, 2026

🟠 CVE-2026-2370 - High (8.1) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace p... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2370/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner