EUVD-2026-17046
GHSA-5369-cwvv-7r63
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege GitLab user
-
DeliveryAccess Jira Connect installation endpoint
-
ExploitBypass authorization checks
-
ExecutionExtract installation credentials
-
ImpactImpersonate GitLab application in Jira
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Parameter handling completeness
|
| Exploitation Conditions | GitLab CE/EE versions 14.3–18.8.6, 18.9.0–18.9.2, 18.10.0 with Jira Connect integration enabled. Requires authenticated GitLab user with minimal workspace permissions. No victim interaction needed. Attacker obtains installation credentials to impersonate GitLab app. |
| Impact | Real-world risk is elevated but requires specific preconditions. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-accessible exploitation with low complexity, but requires low-privileged authentication within a connected Jira workspace. The High confidentiality and integrity impact (C:H/I:H) reflects the ability to steal credentials and impersonate the application, enabling unauthorized data access and potential manipulation of GitLab-Jira integration settings. However, exploitation is constrained to environments actively using GitLab's Jira Connect feature and requires the attacker to already possess some level of legitimate workspace access. No EPSS score or KEV listing is provided, and no public exploit identified at time of analysis, though the detailed HackerOne report may provide exploitation guidance. The SSVC framework would likely classify this as requiring scheduled remediation rather than immediate emergency patching: exploitation requires authentication and specific integration deployment, technical impact is partial (credential theft rather than full system compromise), and no evidence of active exploitation exists. Organizations not using Jira Connect integration face zero risk, while those with the integration enabled should prioritize patching based on their Jira workspace trust model and user access controls. |
| Exploit ScenarioDerived | An attacker with minimal authenticated access to a Jira Cloud workspace connected to a vulnerable GitLab instance sends crafted API requests to GitLab's Jira Connect endpoints, exploiting improper authorization checks to retrieve installation credentials. Using these stolen credentials, the attacker impersonates the legitimate GitLab application integration, enabling them to access confidential repository data synchronized with Jira, modify integration settings to exfiltrate additional information, or manipulate issue tracking data flowing between the platforms. The low attack complexity and network-based vector allow remote exploitation without user interaction once initial Jira workspace access is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 30, 2026
Improper authorization in GitLab CE/EE Jira Connect integration allows authenticated users with minimal workspace permissions to steal installation credentials and impersonate the GitLab application. Affects versions 14.3 through 18.8.6, 18.9.0-18.9.2, and 18.10.0. Vendor-released patches available in versions 18.8.7, 18.9.3, and 18.10.1. High CVSS score (8.1) reflects significant confidentiality and integrity impact with low attack complexity. No public exploit identified at time of analysis, though detailed disclosure exists via HackerOne report.
RemediationAI
Upgrade to patched versions immediately: GitLab 18.8.7 for the 18.8.x series, GitLab 18.9.3 for the 18.9.x series, or GitLab 18.10.1 for the 18.10.x series. Organizations unable to patch immediately should review Jira workspace user permissions to ensure only trusted users have access to connected workspaces, consider temporarily disabling the Jira Connect integration if not business-critical, and audit integration logs for suspicious credential access patterns. Rotate Jira Connect installation credentials after patching if unauthorized access is suspected. Complete remediation guidance and upgrade instructions are available in the official security release announcement at https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/. The GitLab work item tracker at https://gitlab.com/gitlab-org/gitlab/-/work_items/589635 provides additional technical context for security teams.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from CWE-233 (Improper Handling of Parameters) in GitLab's Jira Connect application integration functionality, introduced in version 14.3. The Jira Connect feature allows GitLab to integrate with Atlassian Jira Cloud workspaces, requiring OAuth credentials and installation tokens to authenticate API operations. The authorization flaw permits low-privileged authenticated users within a connected Jira workspace to bypass intended access controls and retrieve sensitive installation credentials that should only be accessible to administrators or the GitLab application itself. These credentials can then be leveraged to perform API operations while impersonating the legitimate GitLab app integration, potentially affecting all GitLab instances with Jira Connect enabled. The vulnerability exists in the application's parameter handling and authorization validation logic, allowing credential exposure through improper enforcement of workspace permission boundaries.
Know when Gitlab gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions to obtain installation credentials and impersonate the GitLab app due to improper authorization checks.
Executive ViewAI
CVE-2026-2370 affects GitLab's Jira Connect integration, allowing authenticated users to steal installation credentials and impersonate the GitLab application, creating potential unauthorized access to integrated systems. Organizations running affected GitLab versions (14.3-18.10.0) face credential compromise risks that could extend to downstream Jira and third-party integrations. This vulnerability requires immediate patching to prevent lateral movement and credential theft.
Vendor-released patch: GitLab 18.8.7, 18.9.3, or 18.10.1. Until patching is complete, restrict GitLab workspace permissions to minimize authenticated user access to Jira Connect integration settings; disable Jira Connect integration if not actively required; monitor integration audit logs for suspicious credential access patterns; enforce multi-factor authentication on all GitLab and Jira administrative accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
Remote code execution in GitLab CE/EE (all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2)
Remote code execution in GitLab CE/EE can be triggered by a specially crafted regular expression processed through a vul
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Cha
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Authenticated code execution on the GitLab server is possible in GitLab CE/EE 19.2 through 19.4.0, where an integer over
Same weakness CWE-233 – Improper Handling of Parameters
View allSame technique Information Disclosure
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| sid | vulnerable | 17.6.5-19 | - |
| (unstable) | fixed | (unfixed) | - |
Exploit-DB