# CERT-FR Flags Multiple GitLab Vulnerabilities

Published: 2026-10-12 · Severity: high · Sectors: technology
Canonical: https://vorant.io/reports/61cc0447-5d1c-5e19-b346-eb160800c487/cert-fr-flags-multiple-gitlab-vulnerabilities

> CERT-FR advisory lists 23 GitLab CE/EE vulnerabilities including RCE, SSRF and XSS; patch to 19.4.2, 19.3.4 or 19.2.8.

CERT-FR issued an advisory covering multiple vulnerabilities in GitLab Community Edition and Enterprise Edition, based on GitLab's own security bulletin released October 12, 2026. Affected versions include 19.3.x prior to 19.3.4, 19.4.x prior to 19.4.2, and all versions prior to 19.2.8. The vulnerabilities collectively enable remote code execution, data confidentiality and integrity breaches, security policy bypass, server-side request forgery (SSRF), and indirect remote code injection (XSS).

The advisory enumerates 23 CVEs without providing exploitation details, severity breakdowns per CVE, or confirmation of in-the-wild exploitation. Defenders running self-managed GitLab instances should prioritize patching to the fixed versions (19.4.2, 19.3.4, or 19.2.8+) referenced in GitLab's patch release notes. No indicators of compromise or active exploitation are mentioned in this bulletin.

## Mentioned in this report

- Vulnerabilities: CVE-2026-100104, CVE-2026-100755, CVE-2026-101168, CVE-2026-103549, CVE-2026-104661, CVE-2026-105458, CVE-2026-14210, CVE-2026-14552, CVE-2026-14814, CVE-2026-16275, CVE-2026-16301, CVE-2026-5954, CVE-2026-6567, CVE-2026-7767, CVE-2026-78335, CVE-2026-81839, CVE-2026-82632, CVE-2026-84284, CVE-2026-85529, CVE-2026-92528, CVE-2026-9268, CVE-2026-92883, CVE-2026-96893, CVE-2026-97229

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1294

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/61cc0447-5d1c-5e19-b346-eb160800c487/cert-fr-flags-multiple-gitlab-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup