Main Vulnerability Database Vulnerabilities #VU134377

Server-Side Request Forgery (SSRF) in Gitlab Community Edition and GitLab Enterprise Edition - CVE-2026-9204

Published: June 11, 2026

Vulnerability identifier: #VU134377

CSH Severity: Low

CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-9204

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to server-side request forgery in Gitaly repository import when validating secondary URLs during repository import. A remote user can supply crafted secondary URLs to disclose sensitive information.

The issue may allow reading arbitrary files from the Gitaly server and accessing internal network resources during repository import.

Affected software

Gitlab Community Edition
GitLab Enterprise Edition

How to mitigate CVE-2026-9204

Install security update from vendor's website.

Gitlab Community Edition - addressed in versions 18.10.8, 18.11.5, 19.0.2
GitLab Enterprise Edition - addressed in versions 18.10.8, 18.11.5, 19.0.2

External References

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-0-2-released/

Related Security Bulletins