CVE-2026-9204 MEDIUM

CVE-2026-9204: Server-Side Request Forgery (SSRF) in GitLab

Vendor Gitlab
Product GitLab
Weakness CWE-918 · SSRF
Published June 11, 2026
Last update June 11, 2026

CVSS base score

5.3/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to read arbitrary files from the Gitaly server and access internal network resources during repository import, due to insufficient validation of secondary URLs.

Key dates

02Disclosure timeline

June 11, 2026 CVE published
June 11, 2026 Record updated