What is the CVSS score of CVE-2026-12635?

CVE-2026-12635 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-12635?

Yes, a patch is available for CVE-2026-12635. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2026-12635

EUVD-2026-39168 LOW

Reliance on Reverse DNS Resolution for a Security-Critical Action (CWE-350)

2026-06-25 cve@gitlab.com

GHSA-px7v-hx94-8wmf

Information Disclosure Gitlab

3.1

CVSS 3.1 · NVD

Severity by source

Vendor (gitlab) PRIMARY

NONE

qualitative

NVD

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.5 LOW

Network vector and no UI required match mirror sync; AC:H for DNS rebinding prerequisite; PR:L for maintainer role; S:C and C:L because internal resource responses cross a security boundary.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (gitlab).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jun 26, 2026 - 18:37 NVD

3.1 (LOW)

Patch available

Jun 25, 2026 - 07:01 EUVD

Analysis Generated

Jun 25, 2026 - 05:33 vuln.today

DescriptionNVD

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to make requests to internal network resources through mirror synchronization due to improper URL validation.

AnalysisAI

Server-side request forgery (SSRF) in GitLab CE/EE allows an authenticated user with maintainer-role permissions to probe and interact with internal network resources by configuring malicious mirror synchronization URLs that bypass GitLab's URL validation controls. The flaw spans an exceptionally wide version range - from 8.3 all the way through the 19.x train - making the population of unpatched instances large. CWE-350 (Reliance on Reverse DNS Resolution) indicates the bypass likely exploits DNS-based validation circumvention rather than a simple allowlist gap. No public exploit or active KEV listing is confirmed at time of analysis, but the maintainer privilege bar is low enough in shared multi-tenant GitLab deployments to materially broaden the attacker population.

Technical ContextAI

GitLab's repository mirroring feature allows maintainers to configure remote URLs against which the GitLab server initiates outbound network connections to pull or push repository data. CWE-350 - Reliance on Reverse DNS Resolution for a Security-Critical Action - indicates the URL validation logic performs security decisions based on DNS resolution at validation time, leaving it susceptible to DNS rebinding or time-of-check/time-of-use (TOCTOU) DNS manipulation. An attacker registers a domain whose DNS record resolves to a permitted external IP during validation but is swapped to an internal RFC-1918 address before the actual synchronization request fires, causing the GitLab application server to make HTTP/S requests to internal infrastructure such as metadata services (e.g., AWS IMDS at 169.254.169.254), internal APIs, or other private services that are network-reachable from the GitLab host. The affected CPE covers all GitLab CE and EE releases from version 8.3 onward, with fixes backported to the 18.11 and 19.0 trains.

RemediationAI

Upgrade to GitLab 18.11.6, 19.0.3, or 19.1.1 as appropriate for your current release train; these are the vendor-confirmed fixed versions per the patch release advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released/. For self-hosted instances that cannot be patched immediately, restrict the maintainer role assignment in sensitive projects to fully trusted internal users, since the attack surface is scoped to maintainer-level actors. Additionally, enforce network-level egress filtering on the GitLab application server to block outbound connections to RFC-1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local ranges (169.254.0.0/16), and loopback - this directly neutralizes the internal pivot capability even if the URL validation bypass succeeds, though it may interfere with legitimate internal mirror configurations. Disabling the repository mirroring feature entirely (Admin Area → Settings → Repository → Repository mirroring) is the most complete workaround but removes pull/push mirror functionality for all projects.