CVE-2026-12635 Overview
CVE-2026-12635 is a server-side request forgery (SSRF) issue in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions from 8.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1. An authenticated user with maintainer role permissions could send requests to internal network resources through repository mirror synchronization due to improper URL validation. The weakness is categorized under CWE-350, reliance on reverse DNS resolution for a security-critical action. GitLab has remediated the issue in the patched releases.
Critical Impact
Authenticated maintainer-role users could pivot to internal network resources via mirror URL validation gaps, exposing services that should not be reachable from the GitLab instance.
Affected Products
- GitLab CE/EE versions 8.3 through 18.11.5
- GitLab CE/EE versions 19.0 through 19.0.2
- GitLab CE/EE versions 19.1 through 19.1.0
Discovery Timeline
- 2026-06-25 - CVE-2026-12635 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-12635
Vulnerability Analysis
The vulnerability resides in GitLab's repository mirror synchronization workflow. Mirror synchronization allows a project to pull from or push to a remote Git repository identified by a user-supplied URL. The URL validation logic failed to consistently block requests to internal network destinations under certain conditions. An authenticated user holding the maintainer role on a project could supply a crafted mirror URL. The GitLab backend would then issue outbound requests to that destination as part of synchronization.
Because the request originates from the GitLab server, it can reach internal services that are not exposed externally. This includes metadata endpoints, internal APIs, and management interfaces on adjacent hosts. The CWE-350 classification indicates the validation relied on hostname-level checks that could be circumvented, for example through DNS records resolving to internal addresses after the validation step.
Root Cause
The root cause is improper URL validation in the mirror synchronization handler. Validation occurred at the hostname or DNS layer rather than enforcing checks against the resolved destination address at request time. This pattern is associated with CWE-350, where security decisions rely on resolution outcomes that can change between the check and the use.
Attack Vector
Exploitation requires an authenticated account with maintainer-role permissions on a project that can configure mirroring. The attacker configures a mirror URL pointing to a host they control or to a domain that resolves to an internal address. When GitLab performs synchronization, it issues HTTP or Git protocol requests to the resolved destination. Response content or timing can reveal whether internal services exist, and in some cases interact with them. The CVSS vector indicates network reach with high attack complexity, low privileges, and no required user interaction.
No verified proof-of-concept code has been published. Refer to the GitLab Patch Release Notes and GitLab Work Item Details for vendor-side fix details.
Detection Methods for CVE-2026-12635
Indicators of Compromise
- Mirror configuration entries on projects pointing to RFC1918 addresses, link-local ranges, or cloud metadata hostnames such as 169.254.169.254.
- Outbound connections from the GitLab application server to internal subnets that do not host legitimate Git remotes.
- Repeated mirror sync failures in production.log or sidekiq.log against unusual hostnames.
Detection Strategies
- Audit the project_mirror_data and remote mirror tables for URLs whose resolved IPs fall inside internal allocation ranges.
- Correlate GitLab audit events for mirror creation and update with network telemetry showing GitLab-initiated requests to internal hosts.
- Alert on user accounts newly granted the maintainer role that immediately configure or modify mirrors.
Monitoring Recommendations
- Forward GitLab application, Sidekiq, and audit logs to a central analytics platform and retain mirror-related events.
- Monitor egress from GitLab nodes with allowlists that exclude internal CIDRs and cloud metadata endpoints.
- Track GitLab version inventory to confirm all instances run a patched release.
How to Mitigate CVE-2026-12635
Immediate Actions Required
- Upgrade GitLab CE/EE to 18.11.6, 19.0.3, or 19.1.1 as appropriate for your release branch.
- Review existing remote mirror configurations and remove any pointing to internal address ranges or metadata services.
- Restrict assignment of the maintainer role and apply least privilege on projects that enable mirroring.
Patch Information
GitLab released fixes in versions 18.11.6, 19.0.3, and 19.1.1. Details are published in the GitLab Patch Release Notes. Self-managed instances should follow standard upgrade procedures for their installation method. GitLab.com is operated by the vendor and is patched by GitLab directly.
Workarounds
- In GitLab Admin Area, under Outbound requests, enable restrictions that block requests to the local network and to link-local and loopback addresses from webhooks and integrations until the upgrade is applied.
- Place GitLab behind an egress proxy that denies traffic to internal CIDRs and cloud metadata endpoints.
- Temporarily disable repository mirroring on sensitive projects until patched versions are deployed.
# Verify the running GitLab version on a self-managed instance
sudo gitlab-rake gitlab:env:info | grep -i version
# Example upgrade on an Omnibus package-based installation
sudo apt-get update && sudo apt-get install gitlab-ee=19.1.1-ee.0
sudo gitlab-ctl reconfigure
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
