CVE-2026-3160: Unintended Proxy or Intermediary ('Confused Deputy') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to view Jira issues outside the configured project scope due to an integration filter functioning only as a display control rather than enforcing access boundaries as specified.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.9.7 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.10.6 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.11.3 - Configuration
Generate the API token from a Jira account that has access only to the desired projects; the GitLab project keys filter controls display and does not restrict token access.
Jira API token used by the GitLab integration project access scope = Only the intended Jira projects
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3160?
CVE-2026-3160 has been categorized as a moderate severity vulnerability.
How do I fix CVE-2026-3160?
To remediate CVE-2026-3160, upgrade GitLab CE/EE to versions 18.9.7, 18.10.6, or 18.11.3 or later.
What is the impact of CVE-2026-3160?
CVE-2026-3160 allows authenticated users to view Jira issues outside their configured project, potentially exposing sensitive information.
Which versions of GitLab are affected by CVE-2026-3160?
CVE-2026-3160 affects GitLab CE/EE versions from 13.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3.
Is CVE-2026-3160 fully mitigated in the patched versions?
Yes, the patched versions of GitLab CE/EE contain fixes that fully mitigate the vulnerabilities described in CVE-2026-3160.