Use of Incorrectly-Resolved Name or Reference in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2026-100755
Published: October 13, 2026
Vulnerability identifier: #VU154160
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-100755
CWE-ID: CWE-706
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to poison cached page content served to other users.
The vulnerability exists due to improper cache key construction in merge request page caching when caching and serving page content. A remote user can exploit the improperly constructed cache keys to poison cached page content served to other users.
Exploitation depends on certain deployment configurations and requires user interaction; the advisory does not specify those configurations.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2026-100755
Install security update from vendor's website.
GitLab Enterprise Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2
Gitlab Community Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2
Gitlab Community Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2