CVE-2026-12635: GitLab Mirror Synchronization SSRF – Patch Available

Technical summary

CVE-2026-12635 is an improper URL validation flaw (CWE-350) in GitLab's mirror synchronization functionality. Affected versions span GitLab 8.3 through 18.11.5, 19.0.0–19.0.2, and 19.1.0. The vulnerability allowed authenticated maintainers to craft malicious mirror URLs that bypassed validation checks, enabling server-side request forgery to internal network addresses. The CVSS 3.1 vector reflects minimal impact: no confidentiality, integrity, or availability compromise was directly achievable through this path, though the underlying capability—forcing the GitLab instance to initiate authenticated requests to restricted resources—represents a meaningful attack surface for reconnaissance or lateral movement.

Business impact

The risk is primarily reconnaissance and lateral movement for attackers who have already gained legitimate maintainer access to a GitLab instance. An insider or compromised maintainer account could map internal network topology, probe service endpoints, or trigger actions on internal systems that trust the GitLab instance. In environments where GitLab runs with elevated network privileges or adjacent to sensitive infrastructure, this could facilitate further compromise. However, because the attack requires existing authenticated access and maintainer role, the overall business risk is moderate and best addressed through access controls and monitoring alongside patching.

Affected systems

GitLab Community Edition (CE) and Enterprise Edition (EE) are affected across three version tracks: all versions from 8.3 up to (but not including) 18.11.6, versions 19.0.0 through 19.0.2, and versions 19.1.0. Organizations running GitLab should verify their installed version against these ranges. Patch versions 18.11.6, 19.0.3, and 19.1.1 or later contain the fix.

Exploitability

Exploitation requires an authenticated user account with maintainer-level permissions on a GitLab project or group. The attacker must interact with the mirror synchronization feature to submit a crafted URL. While the CVSS score of 0 may seem misleading, it reflects the assessment that direct confidentiality, integrity, or availability compromise does not occur; however, the ability to perform SSRF from within a trusted network boundary is a genuine security capability that organizations should not dismiss. Real-world exploitation depends on internal network topology and what services the GitLab instance can reach.

Remediation

Update GitLab to version 18.11.6 or later (for the 18.11 track), 19.0.3 or later (for the 19.0 track), or 19.1.1 or later (for the 19.1 track). If you operate an older version from the 8.3–18.11 range, you must upgrade to at least 18.11.6. No workarounds are provided; patching is the required remediation. Review maintainer role assignments in projects that use mirror synchronization to reduce the window of exposure.

Patch guidance

Prioritize upgrades for instances in security-sensitive environments or those with complex internal network connectivity. Stage patches in lower environments first to validate mirror synchronization behavior post-update. The GitLab team has indicated these are point releases; verify compatibility notes in the official GitLab release notes before production deployment. If you cannot patch immediately, restrict maintainer permissions on projects using mirror synchronization and implement network segmentation to limit internal resources accessible from the GitLab instance.

Detection guidance

Monitor GitLab audit logs and API access logs for unusual mirror synchronization requests, especially those originating from user accounts with recent privilege escalation or unusual login patterns. Look for mirror URLs targeting internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1) or internal hostnames. If you have network flow telemetry, flag outbound connections from the GitLab instance to internal services that would not normally be accessed during routine mirror operations. Check for any failed sync attempts that might indicate fuzzing or reconnaissance.

Why prioritize this

Although the CVSS score is 0, the underlying SSRF capability warrants timely patching because it provides authenticated attackers with a mechanism to probe and interact with internal infrastructure from the GitLab instance. The flaw is not widely exploited in the wild (KEV status is false), but organizations should treat this as a medium-priority patch for any instance exposed to untrusted maintainers or in high-trust network segments. The fix is stable and available across all supported version tracks.

Risk score, explained

The CVSS 3.1 score of 0 reflects the assessment criteria: the vulnerability does not directly achieve CIA impact. However, a score of 0 does not mean zero risk. The flaw enables SSRF, which is inherently dangerous in network environments where the affected system holds trust. The low attack complexity (AC:H reflects specific conditions required), low privileges required (maintainer role, which is elevated but not admin), and no user interaction needed classify this as a sneaky but containable threat best managed through timely patching and role-based access control rather than emergency escalation.

Frequently asked questions