Server-Side Request Forgery (SSRF) in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2026-12635
Published: June 25, 2026
Vulnerability identifier: #VU135184
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-12635
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to make requests to internal network resources.
The vulnerability exists due to improper url validation in repository mirroring when performing mirror synchronization. A remote user can supply a crafted mirror url to make requests to internal network resources.
The issue is triggered through mirror synchronization.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2026-12635
Install security update from vendor's website.
GitLab Enterprise Edition - addressed in versions 18.11.6, 19.0.3, 19.1.1
Gitlab Community Edition - addressed in versions 18.11.6, 19.0.3, 19.1.1
Gitlab Community Edition - addressed in versions 18.11.6, 19.0.3, 19.1.1