CVE-2026-3857: Cross-Site Request Forgery (CSRF) in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.
Other sources
GitLab has remediated an issue that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-3857?
CVE-2026-3857 is classified as a moderate severity vulnerability due to its potential impact on authenticated users.
How do I fix CVE-2026-3857?
To fix CVE-2026-3857, update your GitLab instance to version 18.10.1 or later.
Which versions of GitLab are affected by CVE-2026-3857?
CVE-2026-3857 affects GitLab CE/EE versions between 17.10 and 18.10.1, inclusive.
What type of vulnerability is CVE-2026-3857?
CVE-2026-3857 is a Cross-Site Request Forgery vulnerability in the GLQL API of GitLab.
Can an unauthenticated user exploit CVE-2026-3857?
Yes, an unauthenticated user could exploit CVE-2026-3857 to execute arbitrary GraphQL mutations on behalf of authenticated users.