CVE Watch15 jul 2026

CVE-2026-2370

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1

CVSS

8.1

Alto

EPSS

0.4%

p35

KEV

—

Exploit Today

0-100

Publicado: 30 mar 2026 · Última mod.: 15 jul 2026 · CWE-233

EPSS · 30d

0.4%EPSS · 30 días0.4%

2026-06-302026-07-16

Descripción técnica

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions to obtain installation credentials and impersonate the GitLab app due to improper authorization checks.

Referencias oficiales

about.gitlab.comhttps://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/
gitlab.comhttps://gitlab.com/gitlab-org/gitlab/-/work_items/589635
hackerone.comhttps://hackerone.com/reports/3522829
access.redhat.comhttps://access.redhat.com/security/cve/CVE-2026-2370
bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2452920
security.access.redhat.comhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2370.json

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-05156.2 MED

1.6%

——0Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel.2d