GitLab CVE coverage for self-managed DevSecOps, source-code management, CI/CD, and exposed developer platforms.
Vendor watch hub
The GitLabwatch hub is a vendor-specific view inside ITECS MSP Threat Radar. We pull the latest security advisories, incidents, and known-exploited CVEs directly from the official feeds below, score each one for MSP relevance, and surface what's most likely to need attention this week.
At a glance
Tracked
Active
Featured
Unique CVEs
Most recent entry
Apr 22, 2026, 12:16 PM
Feed refreshes daily · 5:15 a.m. Central
Sources·CISA KEV and NVD (product vendor coverage)
"Most recent entry" is the newest item the upstream feed has published — not our sync time.
Watch items
Showing the 5 most recent items, newest first. Each row links to the official advisory.
5 rows · sorted newest first
Operations viewGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.4 and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session due to improper path validation under certain conditions.
GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.
GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API.
GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.
GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files. Known ransomware use: Known.
| Alert | Exposure | Status | Published | Source |
|---|---|---|---|---|
gitlab vulnerability (CVE-2026-5816)GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.4 and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session due to improper path validation under certain conditions. gitlab | HIGHCVE-2026-5816 Watch | watch | Apr 22, 2026, 12:16 PM | NVDOpen source |
GitLab Server-Side Request Forgery (SSRF) VulnerabilityGitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled. GitLab | criticalCVE-2021-22175 Critical | active | Feb 17, 2026, 6:00 PM | CISA KEVOpen source |
GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) VulnerabilityGitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API. Community and Enterprise Editions | criticalCVE-2021-39935 Critical | active | Feb 2, 2026, 6:00 PM | CISA KEVOpen source |
GitLab Community and Enterprise Editions Improper Access Control VulnerabilityGitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover. GitLab CE/EE | criticalCVE-2023-7028 Critical | active | Apr 30, 2024, 7:00 PM | CISA KEVOpen source |
GitLab Community and Enterprise Editions Remote Code Execution VulnerabilityGitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files. Known ransomware use: Known. Community and Enterprise Editions | criticalCVE-2021-22205 Critical | active | Nov 2, 2021, 7:00 PM | CISA KEVOpen source |
Related vendors
ITECS response pathways
These pathways connect the vendor watch feed into service-owner resources that already carry commercial authority.
Use the cybersecurity services pathway when this vendor alert needs an ITECS-managed response plan.
Connect the vendor watch page to broader managed detection, response, and governance planning.
Translate current watch items into a faster risk snapshot and prioritized remediation plan.
Return to the hub for cross-vendor prioritization, live filtering, and broader MSP threat context.
Vendor watch FAQ
It is the GitLab-specific view inside ITECS Threat Radar, built to track recent advisories, incidents, and watch items that may affect Dallas-area business operations.
Use it to confirm whether current GitLab issues overlap with your environment, prioritize remediation, and decide whether you need an assessment, managed security follow-through, or vendor-specific hardening work.
Yes. ITECS can help map GitLab advisories against your systems, validate affected services, prioritize remediation, and connect the issue to broader managed cybersecurity or managed IT workflows.