CVE-2026-2370
High · 8.1CVSS
8.1
EPSS
0.4%
Published
Mar 30, 2026
CISA due date
—
The record
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions to obtain installation credentials and impersonate the GitLab app due to improper authorization checks.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | gitlab-docker-machine-18.10 | 0 | 18.10.1-r0 |
| Chainguard | gitlab-docker-machine-fips-18.10 | 0 | 18.10.1-r0 |
| Chainguard | gitlab-runner-18.10 | 0 | 18.10.1-r0 |
| Chainguard | gitlab-runner-fips-18.10 | 0 | 18.10.1-r0 |
| Chainguard | gitlab-runner-helper-18.10 | 0 | 18.10.1-r0 |
| Chainguard | gitlab-runner-helper-compat-18.10 | 0 | 18.10.1-r0 |
| Chainguard | gitlab-runner-helper-compat-fips-18.10 | 0 | 18.10.1-r0 |
| Chainguard | gitlab-runner-helper-fips-18.10 | 0 | 18.10.1-r0 |
| Chainguard | gitlab-runner-helper-oci-entrypoint-18.10 | 0 | 18.10.1-r0 |
| Chainguard | gitlab-runner-helper-oci-entrypoint-fips-18.10 | 0 | 18.10.1-r0 |
| Chainguard | gitlab-runner-oci-entrypoint-18.10 | 0 | 18.10.1-r0 |
| Chainguard | gitlab-runner-oci-entrypoint-fips-18.10 | 0 | 18.10.1-r0 |
| Wolfi | gitlab-docker-machine-18.10 | 0 | 18.10.1-r0 |
| Wolfi | gitlab-runner-18.10 | 0 | 18.10.1-r0 |
| Wolfi | gitlab-runner-helper-18.10 | 0 | 18.10.1-r0 |
| Wolfi | gitlab-runner-helper-compat-18.10 | 0 | 18.10.1-r0 |
| Wolfi | gitlab-runner-helper-oci-entrypoint-18.10 | 0 | 18.10.1-r0 |
| Wolfi | gitlab-runner-oci-entrypoint-18.10 | 0 | 18.10.1-r0 |
Related vulnerabilities
- CVE-2025-15558 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins… Also affects gitlab-runner-18.10
- CVE-2026-32998 This vulnerability in Veeam Service Provider Console allows for remote code execution. CWE-233
- CVE-2026-33585 Improper management of the idle timeout parameter in the Keycloak interface of the Arqit… CWE-233
- CVE-2018-25233 WebDrive 18.00.5057 contains a denial of service vulnerability that allows local… CWE-233
- CVE-2023-20514 Improper handling of parameters in the AMD Secure Processor (ASP) could allow a… CWE-233
- CVE-2026-22626 Due to insufficient input parameter validation on the interface, authenticated users of… CWE-233
- CVE-2024-25979 The URL parameters accepted by forum search were not limited to the allowed parameters. CWE-233