REDHAT-BUG-2428224: High severity GitLab GitLab EE vulnerability
GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to access and utilize AI model settings from unauthorized namespaces by manipulating namespace identifiers in API requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.5.5 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.6.3 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.7.1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2428224?
The severity of REDHAT-BUG-2428224 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2428224?
To fix REDHAT-BUG-2428224, upgrade your GitLab EE to version 18.5.5, 18.6.3, or 18.7.1 or later.
What versions of GitLab EE are affected by REDHAT-BUG-2428224?
REDHAT-BUG-2428224 affects GitLab EE versions prior to 18.5.5, 18.6.3, and 18.7.1.
What impact does REDHAT-BUG-2428224 have on GitLab users?
REDHAT-BUG-2428224 could allow authenticated users to access and use AI model settings from unauthorized namespaces.
When was REDHAT-BUG-2428224 published?
REDHAT-BUG-2428224 was published on January 9, 2026.