What is the CVSS score of CVE-2026-7471?

CVE-2026-7471 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-7471?

Yes, a patch is available for CVE-2026-7471. Update the affected software to the latest version immediately.

GitLab EE CVE-2026-7471

EUVD-2026-30239 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-14 cve@gitlab.com

GHSA-v3gx-42r7-j2h7

Gitlab SSRF

3.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.5 LOW

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:53 vuln.today

Patch available

May 14, 2026 - 07:16 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with control of a virtual registry upstream to make requests to internal hosts due to improper validation.

AnalysisAI

Server-Side Request Forgery (SSRF) in GitLab Enterprise Edition's virtual registry upstream feature allows an authenticated low-privileged user who controls a virtual registry upstream to direct the GitLab server to issue HTTP requests against internal hosts that would otherwise be inaccessible from the network perimeter. Affected versions span GitLab EE 18.8 through 18.11 across three patch trains. No public exploit exists and no active exploitation has been identified at time of analysis; EPSS probability stands at 0.01%, consistent with the narrow preconditions required.

Technical ContextAI

CWE-918 (Server-Side Request Forgery) describes a class of vulnerabilities where an application fetches a remote resource based on attacker-supplied URL input without adequately validating the destination. In GitLab EE's virtual registry feature, upstream sources are configurable endpoints that the GitLab server contacts on behalf of registry operations. The improper validation of these upstream URLs means the server does not enforce an allowlist or block reserved/internal address ranges, enabling the application to be weaponised as a proxy into the internal network. The affected CPE is cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*, confirming the vulnerability is exclusive to the Enterprise Edition product line and not present in the Community Edition. The Changed scope (S:C) in the CVSS vector reflects that the impact escapes the vulnerable GitLab component and reaches back-end services on the internal network, even though the confidentiality impact is rated low (C:L) given the limited data typically returned from blind or semi-blind SSRF.

RemediationAI

Upgrade to one of the patched releases corresponding to the installed branch: GitLab EE 18.9.7, 18.10.6, or 18.11.3, all of which include the fix per the GitLab patch release advisory at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. The vendor-released patch is confirmed available. As a compensating control for organisations unable to patch immediately, restricting which users or roles have permission to configure virtual registry upstreams reduces the attack surface to a smaller, more trusted population; note that this does not eliminate the vulnerability but raises the privilege bar above the current low-privilege threshold. Additionally, enforcing network-level egress filtering on the GitLab application server to block requests to RFC-1918 addresses and cloud metadata endpoints (e.g., 169.254.169.254) limits the practical reach of any SSRF exploitation. The trade-off of egress filtering is potential disruption to legitimate outbound integrations, so rule crafting should be tested in staging first.