GitLab CE/EE: crafted sequences let an authenticated user drive unintended internal requests via the proxy

Impact

An authenticated GitLab user can inject crafted sequences that make the server issue unintended internal requests through its proxy configuration - a server-side request forgery class issue against whatever the GitLab instance can reach. In a GPU fleet GitLab is usually the CI/CD and registry front end, sitting on a network that also reaches the cluster API, internal registries, metadata endpoints and secret stores, so the value of this bug is the reach of the GitLab host rather than the GitLab data itself. Affects all versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2.

Who can reach it

Any authenticated user of the GitLab instance, over the network. No elevated GitLab role is described as required. Exploitability depends on the instance running behind a proxy configuration.

What to do

Upgrade to GitLab 18.1.6, 18.2.6 or 18.3.2 (or later) and restart the GitLab services - a maintenance window on the GitLab host, no GPU-node impact. The 2025-09-10 patch release post carries the details.

References

Related entries

• GitLab EE: a developer with group management permissions can escalate to broader system capabilitiesCVE-2025-7691 · GitLab EE (group management permissions)High
• N-able N-central: Improper input validationCVE-2025-8876 · N-able N-centralHigh
• Grafana: symlink escape in plugin archive extraction gives remote code execution as the Grafana processCVE-2026-15815 · Grafana OSS / Enterprise (plugin archive extraction)High
• Kubeflow Training Operator (RHOAI overlay, trainjobs aggregated into the edit ClusterRole): The RHOAI overlayCVE-2026-18951 · Kubeflow Training Operator (RHOAI overlay, trainjobs aggregated into the edit ClusterRole)High
• NetApp ONTAP WebAuthn multi-factor authentication (Relying Party ID): An attacker who already has valid credentialsCVE-2026-22049 · NetApp ONTAP WebAuthn multi-factor authentication (Relying Party ID)High
• Jenkins: symlinks in tar archives let a job or agent write files anywhere the controller canCVE-2026-33001 · Jenkins controller (.tar/.tar.gz extraction, symlink handling)High