CVE-2026-7767 MEDIUM

CVE-2026-7767: URL Redirection to Untrusted Site ('Open Redirect') in GitLab

Vendor Gitlab
Product GitLab
Weakness CWE-601 · Open redirect
Published October 13, 2026
Last update October 13, 2026

CVSS base score

5.8/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction Required
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to an unintended server due to improper redirect validation in the Kubernetes proxy.

Key dates

02Disclosure timeline

October 13, 2026 CVE published

Related vulnerabilities

04Related CVE