CVE WatchJul 15, 2026

CVE-2026-2370

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1

CVSS

8.1

High

EPSS

0.4%

p35

KEV

—

Exploit Today

0-100

Published: Mar 30, 2026 · Last modified: Jul 15, 2026 · CWE-233

EPSS · 30d

0.4%EPSS · 30 days0.4%

2026-06-302026-07-16

Technical description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions to obtain installation credentials and impersonate the GitLab app due to improper authorization checks.

Official references

about.gitlab.comhttps://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/
gitlab.comhttps://gitlab.com/gitlab-org/gitlab/-/work_items/589635
hackerone.comhttps://hackerone.com/reports/3522829
access.redhat.comhttps://access.redhat.com/security/cve/CVE-2026-2370
bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2452920
security.access.redhat.comhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2370.json

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-05156.2 MED

1.6%

——0Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel.2d