GitLab CE/EE: injected content can lead to account takeover in versions from 14.10

Impact

An attacker can inject malicious content into GitLab CE/EE that may lead to takeover of another user's account; the CVSS vector requires one click from the victim and reports a scope change. Self-managed GitLab is usually the thing that holds the fleet's CI credentials, container-registry push rights and GitOps deploy keys, so an account takeover there is not contained to a code-review tool - it is a route to the images and manifests that land on GPU nodes. The record is thin on mechanism and the GitLab issue is the only detail available. Affected: all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1.

Who can reach it

Remote, over the GitLab web interface, against a logged-in user who must interact with the injected content. The vector reports no privileges required for the attacker beyond being able to place the content.

What to do

Upgrade self-managed GitLab to 18.2.7, 18.3.3 or 18.4.1 depending on your branch, then restart the application - a standard GitLab upgrade window, no node reboots. After patching, review admin and CI-service accounts for unexpected sessions, tokens and runner registrations, and rotate anything a taken-over maintainer could have reached. GitLab.com is already patched.

References

Related entries

• AAP Controller: testing a Vault credential sends the controller pod's service account token to an attacker URLCVE-2026-12564 · Red Hat Ansible Automation Platform Controller (awx_plugins HashiCorp Vault credential plugin)Critical
• Termix: any authenticated user can read other users' stored SSH and sudo passwordsCVE-2026-53548 · Termix (GET /host/db/host/:id/password credential endpoint)Critical
• Progress LoadMaster (ADC): OS command injection in the APICVE-2026-8037 · Progress LoadMaster (ADC)Critical
• Vault Secrets Operator: tenant-controlled AppRole config reads operator pod files and exfiltrates themCVE-2026-8715 · HashiCorp Vault Secrets Operator (AppRole secretIDPath configuration)Critical
• Johnson Controls Metasys Application and Data Server (ADS) deployed with SQL Express: Command injection on the MetasysCVE-2025-26385 · Johnson Controls Metasys Application and Data Server (ADS) deployed with SQL ExpressCritical
• Citrix NetScaler ADC/Gateway: unauthenticated attacker executes arbitrary commands on the applianceCVE-2026-88771 · Citrix NetScaler ADC / Gateway (input validation in the management/authentication request path)Critical