CVE-2026-7471: Server-Side Request Forgery (SSRF) in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with control of a virtual registry upstream to make requests to internal hosts due to improper validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.9.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.10.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.11.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7471?
The severity of CVE-2026-7471 is classified as high due to its potential for Server-Side Request Forgery (SSRF) attacks.
How do I fix CVE-2026-7471?
To fix CVE-2026-7471, upgrade GitLab EE to versions 18.9.7, 18.10.6, or 18.11.3 or later.
Who is affected by CVE-2026-7471?
CVE-2026-7471 affects users of GitLab EE versions 18.8 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3.
What types of attacks does CVE-2026-7471 allow?
CVE-2026-7471 allows authenticated users to perform Server-Side Request Forgery (SSRF) attacks.
What versions of GitLab are vulnerable to CVE-2026-7471?
Versions of GitLab EE from 18.8 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 are vulnerable to CVE-2026-7471.