CVE-2026-10733: GitLab CI/CD Catalog DoS Vulnerability – Patch Guidance

Technical summary

The vulnerability stems from improper sanitization of user input on the CI/CD Catalog page (CWE-1021: Improper Restriction of Rendered UI Layers or Frames). When an authenticated user supplies specially crafted input that bypasses sanitization controls, the application fails to validate or escape the data correctly, leading to resource exhaustion or unhandled exceptions that crash the Catalog interface. The flaw affects GitLab CE and EE across a broad version range: all 17.0.x releases, 18.0–18.10.7, 18.11.0–18.11.4, and 19.0.0–19.0.1.

Business impact

The DoS condition is scoped to the CI/CD Catalog page, so it does not disable the entire GitLab instance or stop CI/CD pipelines themselves. However, teams relying on the Catalog to discover and share CI/CD components may experience workflow disruption. For organizations using GitLab's Catalog as a central repository for pipeline templates and reusable jobs, intermittent unavailability could slow deployment velocity and frustrate teams during critical release windows. The impact is moderate and localized unless the Catalog is heavily integrated into your standard pipeline workflows.

Affected systems

GitLab Community Edition (CE) and Enterprise Edition (EE) are both affected. Vulnerable versions span from 17.0 through 18.10.7, 18.11.0 through 18.11.4, and 19.0.0 through 19.0.1. Organizations running GitLab 18.10.8 or later, 18.11.5 or later, or 19.0.2 or later have already received patches. Self-hosted GitLab installations are at the most direct risk; SaaS customers on GitLab.com should verify their instance version, as GitLab typically patches SaaS deployments first.

Exploitability

Exploitation requires valid GitLab user credentials, which significantly limits the threat surface. An attacker cannot trigger this vulnerability from outside the system or via unauthenticated access. Once authenticated, however, the exploit is trivial—no special privileges, complex interactions, or user interaction are needed. Any authenticated user, including those with minimal repository access, can crash the Catalog page. The CVSS 3.1 score of 4.3 (MEDIUM) reflects this: low attack complexity and low privilege requirement, but authentication as a mandatory prerequisite. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities catalog, suggesting no active in-the-wild exploitation has been reported.

Remediation

Upgrade to patched versions: 18.10.8, 18.11.5, 19.0.2, or later. For organizations unable to upgrade immediately, restrict CI/CD Catalog page access via role-based access controls (RBAC) to trusted users only, or disable the feature if not in active use. Monitor GitLab logs for unusual activity on the Catalog endpoint to detect attempts at exploitation.

Patch guidance

Verify the recommended patches against the GitLab advisory: Community Edition users should update to 18.10.8 or later; Enterprise Edition users on the 18.11 track should update to 18.11.5 or later; and all users on 19.0 should update to 19.0.2 or later. Test patches in a non-production environment first, particularly if you have custom CI/CD Catalog integrations. GitLab publishes security releases on the 16th of each month; check your vendor advisory for exact release timelines and any breaking changes.

Detection guidance

Monitor HTTP 5xx error rates and response timeouts on the `/api/v4/projects/:id/catalog/resources` endpoint and related Catalog UI routes. Check GitLab application logs for unhandled exceptions or stack traces originating from Catalog-related code paths. Detect authentication logs paired with rapid Catalog API calls or unusual payloads. If you operate a SIEM, create alerts for repeated failed Catalog requests from the same user within a short time window, which may signal exploitation attempts. Review audit logs to identify which users accessed the Catalog page during any observed outages.

Why prioritize this

This vulnerability should be prioritized for patching within the next 30 days, but it is not a critical incident. The MEDIUM severity, authentication requirement, and limited scope (Catalog page only) mean it poses less risk than unauth'd RCE or data exposure flaws. However, if your organization relies on the Catalog for routine CI/CD operations, or if you allow a large number of internal users to access GitLab, prioritize higher to minimize disruption. Teams managing high-change-velocity environments should patch sooner to avoid Catalog downtime during release cycles.

Risk score, explained

The CVSS 3.1 base score of 4.3 reflects a flaw that is easily exploitable by authenticated insiders but offers no confidentiality or integrity impact—only availability loss. The vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) indicates network-accessible, low attack complexity, low privilege requirement, no user interaction needed, and a minor availability impact. The score correctly captures a low-to-moderate risk: not an emergency, but not negligible either, especially if internal user trust is assumed.

Frequently asked questions