CVE-2026-1094
Medium · 4.6CVSS
4.6
EPSS
0.2%
Published
Feb 11, 2026
CISA due date
—
The record
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 18.8.4 that could have allowed an authenticated developer to hide specially crafted file changes from the WebUI.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | gitlab-docker-machine-fips-18.8 | 0 | 18.8.0-r2 |
| Chainguard | gitlab-pages-fips-18.8 | 0 | 18.8.4-r0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.8 | 0 | 18.8.4-r0 |
| Chainguard | gitlab-rails-ce-doc-fips-18.8 | 0 | 18.8.4-r0 |
| Chainguard | gitlab-rails-ce-fips-18.8 | 0 | 18.8.4-r0 |
| Chainguard | gitlab-runner-18.8 | 0 | 18.8.0-r1 |
| Chainguard | gitlab-runner-fips-18.8 | 0 | 18.8.0-r2 |
| Chainguard | gitlab-runner-helper-18.8 | 0 | 18.8.0-r1 |
| Chainguard | gitlab-runner-helper-compat-18.8 | 0 | 18.8.0-r1 |
| Chainguard | gitlab-runner-helper-compat-fips-18.8 | 0 | 18.8.0-r2 |
| Chainguard | gitlab-runner-helper-fips-18.8 | 0 | 18.8.0-r2 |
| Chainguard | gitlab-runner-helper-oci-entrypoint-18.8 | 0 | 18.8.0-r1 |
| Chainguard | gitlab-runner-helper-oci-entrypoint-fips-18.8 | 0 | 18.8.0-r2 |
| Chainguard | gitlab-runner-oci-entrypoint-18.8 | 0 | 18.8.0-r1 |
| Chainguard | gitlab-runner-oci-entrypoint-fips-18.8 | 0 | 18.8.0-r2 |
| Wolfi | gitlab-runner-18.8 | 0 | 18.8.0-r1 |
| Wolfi | gitlab-runner-helper-18.8 | 0 | 18.8.0-r1 |
| Wolfi | gitlab-runner-helper-compat-18.8 | 0 | 18.8.0-r1 |
| Wolfi | gitlab-runner-helper-oci-entrypoint-18.8 | 0 | 18.8.0-r1 |
| Wolfi | gitlab-runner-oci-entrypoint-18.8 | 0 | 18.8.0-r1 |
Related vulnerabilities
- CVE-2026-1182 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.14 before… Also affects gitlab-docker-machine-fips-18.8
- CVE-2026-1282 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before… Also affects gitlab-docker-machine-fips-18.8
- CVE-2026-1456 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before… Also affects gitlab-docker-machine-fips-18.8
- CVE-2026-1458 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.0 before… Also affects gitlab-docker-machine-fips-18.8
- CVE-2026-0595 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before… Also affects gitlab-docker-machine-fips-18.8
- GHSA-3966-f6p6-2qr9 Duplicate Advisory: npm cli Uncontrolled Search Path Element Local Privilege Escalation… Also affects gitlab-rails-ce-assets-fips-18.8
- CVE-2026-0775 npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. Also affects gitlab-rails-ce-assets-fips-18.8
- CVE-2026-24001 jsdiff is a JavaScript text differencing implementation. Also affects gitlab-rails-ce-assets-fips-18.8