What is the CVSS score of CVE-2026-2370?

CVE-2026-2370 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-2370?

Within 24 hours: Identify all GitLab instances running versions 14.3-18.10.0 and audit active Jira Connect integrations. Within 7 days: Apply vendor-released patches (upgrade to GitLab 18.8.7, 18.9.3, or 18.10.1 depending on current version). Within 30 days: Audit Jira integration logs for unauthorized credential access, rotate all GitLab Jira Connect OAuth tokens, and review IAM logs for any impersonation attempts.

Gitlab CVE-2026-2370

Q: Which versions of Gitlab are affected by CVE-2026-2370?

CVE-2026-2370 affects GitLab's Jira Connect integration, allowing authenticated users to steal installation credentials and impersonate the GitLab application, creating potential unauthorized access…. A patch is available.

EUVD-2026-17046 HIGH

Improper Handling of Parameters (CWE-233)

2026-03-30 cve@gitlab.com

GHSA-5369-cwvv-7r63

Gitlab Information Disclosure Atlassian

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

8.1 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jun 30, 2026 - 03:24 NVD

8.1 (HIGH) 8.8 (HIGH)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 30, 2026 - 00:22 euvd

EUVD-2026-17046

Analysis Generated

Mar 30, 2026 - 00:22 vuln.today

CVE Published

Mar 30, 2026 - 00:16 nvd

HIGH 8.1

DescriptionNVD

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions to obtain installation credentials and impersonate the GitLab app due to improper authorization checks.

AnalysisAI

Improper authorization in GitLab CE/EE Jira Connect integration allows authenticated users with minimal workspace permissions to steal installation credentials and impersonate the GitLab application. Affects versions 14.3 through 18.8.6, 18.9.0-18.9.2, and 18.10.0. Vendor-released patches available in versions 18.8.7, 18.9.3, and 18.10.1. High CVSS score (8.1) reflects significant confidentiality and integrity impact with low attack complexity. No public exploit identified at time of analysis, though detailed disclosure exists via HackerOne report.

Technical ContextAI

This vulnerability stems from CWE-233 (Improper Handling of Parameters) in GitLab's Jira Connect application integration functionality, introduced in version 14.3. The Jira Connect feature allows GitLab to integrate with Atlassian Jira Cloud workspaces, requiring OAuth credentials and installation tokens to authenticate API operations. The authorization flaw permits low-privileged authenticated users within a connected Jira workspace to bypass intended access controls and retrieve sensitive installation credentials that should only be accessible to administrators or the GitLab application itself. These credentials can then be leveraged to perform API operations while impersonating the legitimate GitLab app integration, potentially affecting all GitLab instances with Jira Connect enabled. The vulnerability exists in the application's parameter handling and authorization validation logic, allowing credential exposure through improper enforcement of workspace permission boundaries.

RemediationAI

Upgrade to patched versions immediately: GitLab 18.8.7 for the 18.8.x series, GitLab 18.9.3 for the 18.9.x series, or GitLab 18.10.1 for the 18.10.x series. Organizations unable to patch immediately should review Jira workspace user permissions to ensure only trusted users have access to connected workspaces, consider temporarily disabling the Jira Connect integration if not business-critical, and audit integration logs for suspicious credential access patterns. Rotate Jira Connect installation credentials after patching if unauthorized access is suspected. Complete remediation guidance and upgrade instructions are available in the official security release announcement at https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/. The GitLab work item tracker at https://gitlab.com/gitlab-org/gitlab/-/work_items/589635 provides additional technical context for security teams.