GitLab CVE-2026-1168

The prerequisite is a GitLab CE/EE instance running an affected version with its GraphQL API endpoint reachable by the attacker (normally /api/graphql, enabled by default and commonly exposed wherever the web UI is exposed). The attacker must be able to reach the endpoint without authenticating, i.e. it must not be behind an authenticating reverse proxy, IP allowlist, or VPN - GitLab permits a subset of GraphQL operations without credentials, and the advisory states the impact is reachable by an unauthenticated user, so this is a pre-existing exposure rather than a special configuration toggle. What limits real-world exploitation: the flaw is in complexity estimation, so the specific query shapes needed mirror whatever the POC uses and may need tuning against the target's instance size - small instances can be knocked over more easily, while very large horizontally scaled deployments require proportionally more traffic; additionally, the impact is availability only (no data read or write), so an attacker gains nuisance/denial value rather than access, and instances that already gate /api/graphql behind a WAF, rate limiter, or network allowlist (a common hardening step, though not the default) are effectively shielded.

The signals here agree rather than conflict: CVSS 3.1 is 7.5 with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, meaning a remote, unauthenticated, no-interaction attack with low complexity that degrades availability only - a textbook availability-flood profile rather than a data-breach profile, which is why the score stops at High instead of Critical. The description explicitly says 'unauthenticated user', and the vector's PR:N is consistent with that, so no authentication precondition should be assumed. Public exploit code exists (HackerOne report 3461590), which raises the practical likelihood that opportunistic actors replicate the technique, but GitLab's GraphQL endpoint exposure and the fact that this targets availability rather than data mean the payoff is vandalism-grade: even a mid-sized operator such as a municipal IT team in boleslawiec should treat this as a genuine uptime risk during peak pipeline hours, though not as a data-compromise emergency. No EPSS score was provided in this record and the CVE is not in CISA KEV, so widespread exploitation is unconfirmed and any claim of active campaigns would be unsupported. The main caveat is the missing EPSS value and the wildcarded CPE - verify the exact vulnerable build against the vendor advisory rather than assuming every GitLab instance is affected.

An unauthenticated attacker sends a series of carefully shaped GraphQL queries to a reachable GitLab /api/graphql endpoint, choosing nested or high-fan-out selections that the complexity calculator scores as cheap. Each request costs the server far more work than the estimator assumes, so a modest request volume drives CPU, database connections, or worker saturation until the instance stops serving legitimate users - including git pushes, CI jobs, and the web UI. Publicly available exploit code from the linked HackerOne report makes replication straightforward for anyone with network reachability to the target.