# Multiple vulnerabilities in GitLab CE and EE

Published: 2026-06-11 · Severity: routine
Canonical: https://vorant.io/reports/4d2a09a3-b157-5dc7-ab47-553226e75b03/multiple-vulnerabilities-in-gitlab-ce-and-ee

> GitLab CE and EE versions prior to 18.10.8, 18.11.5, and 19.0.2 contain multiple vulnerabilities allowing RCE, DoS, SSRF, and XSS.

CERT-FR has published a security advisory covering multiple vulnerabilities affecting GitLab Community Edition and Enterprise Edition. The affected versions include all releases prior to 18.10.8, 18.11.x prior to 18.11.5, and 19.0.x prior to 19.0.2. The vulnerabilities enable remote code execution, denial of service, server-side request forgery (SSRF), security policy bypass, and cross-site scripting (XSS). Defenders using GitLab should prioritize patching to the fixed versions: 18.10.8 or later, 18.11.5 or later, or 19.0.2 or later. The advisory references a GitLab security bulletin released on 10 June 2026 with complete remediation details.

## Mentioned in this report

- Vulnerabilities: CVE-2026-10087, CVE-2026-10733, CVE-2026-1500, CVE-2026-3553, CVE-2026-6269, CVE-2026-6277, CVE-2026-6552, CVE-2026-6976, CVE-2026-7250, CVE-2026-8589, CVE-2026-9204, CVE-2026-9694

## Detection guidance (public sample)

### GitLab Application Process Spawning Shell With Download or Reverse-Shell Commands

ATT&CK: T1190

GitLab embedded Ruby/Puma/Sidekiq/Workhorse processes spawning a shell that runs download-and-execute or reverse-shell commands, consistent with post-exploitation of a GitLab RCE flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: GitLab Application Process Spawning Shell With Download or Reverse-Shell Commands
description: Detects a shell spawned by GitLab embedded application processes (ruby,
  puma, sidekiq, workhorse under the Omnibus embedded directory) whose command line
  contains download-and-execute or reverse-shell patterns. This is typical post-exploitation
  behaviour after exploiting a remote code execution vulnerability in a public-facing
  GitLab instance. The advisory gives no exploit specifics, so this rule targets the
  resulting behaviour only.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains: /opt/gitlab/embedded/
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - curl
    - wget
    - /dev/tcp/
    - nc -e
    - ncat
    - base64 -d
    - python -c
    - perl -e
    - mkfifo
  condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Custom GitLab integrations or admin scripts that call curl or wget through a shell
  from a Sidekiq job
- Health-check or maintenance hooks that shell out from GitLab Ruby processes
level: medium
id: 1d644e0b-eef7-512e-98b2-96982330c3b9
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0733
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0733

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4d2a09a3-b157-5dc7-ab47-553226e75b03/multiple-vulnerabilities-in-gitlab-ce-and-ee.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup