CVE-2026-100104: Server-Side Request Forgery (SSRF) in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a time-of-check to time-of-use race condition in URL validation during repository import operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.2.8 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.5 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.4.2
Event History
Frequently Asked Questions
Which GitLab versions need remediation?
Affected versions are GitLab CE/EE from 10.3 up to, but not including, 19.2.8; the 19.3 release line before 19.3.5; and the 19.4 release line before 19.4.2. Upgrade to 19.2.8, 19.3.5, 19.4.2, or a later release in the applicable release line.
What access does an attacker need to exploit this issue?
An attacker must be an authenticated GitLab user and must be able to use repository import operations. Exploitation also depends on winning a race condition during URL validation.
What could a successful exploit allow?
A successful exploit could allow server-side requests to internal network resources. The provided severity data indicates low confidentiality impact and no integrity or availability impact.
Are GitLab instances on default configurations necessarily affected?
The available information does not state whether the vulnerable repository import conditions are enabled or reachable in a default configuration. Exposure depends on the affected version and the conditions surrounding repository import operations.