CVE-2026-12910 Overview
CVE-2026-12910 is an authentication bypass vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). Under certain conditions, an authenticated user can bypass SAML Single Sign-On (SSO) sign-in restrictions and authenticate without SSO. The root cause is missing authentication enforcement checks in the affected GitLab code paths. The flaw is classified under [CWE-306] (Missing Authentication for Critical Function).
Critical Impact
Authenticated users can circumvent SAML SSO enforcement, weakening identity controls and enabling access paths outside the organization's configured identity provider.
Affected Products
- GitLab CE/EE versions 18.6 through 19.1.7
- GitLab CE/EE versions 19.2 through 19.2.5
- GitLab CE/EE versions 19.3 through 19.3.1
Discovery Timeline
- 2026-09-15 - CVE-2026-12910 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-12910
Vulnerability Analysis
GitLab groups can require members to authenticate through a SAML identity provider before accessing group resources. This SSO enforcement is a foundational control for organizations centralizing identity, session policy, and multi-factor authentication in an external identity provider.
CVE-2026-12910 breaks that guarantee. Certain authenticated request paths in GitLab CE/EE do not enforce the SAML SSO check, allowing a user with valid GitLab credentials to interact with SSO-restricted resources without completing an SSO sign-in. The attack requires network access to the GitLab instance and low-privilege authenticated access. No user interaction is required.
Root Cause
The vulnerability stems from missing authentication enforcement checks [CWE-306] on specific code paths that should validate an active SAML SSO session before authorizing access. When the enforcement check is absent, GitLab treats the user's underlying session as sufficient, ignoring the group-level SSO requirement.
Attack Vector
An authenticated attacker sends requests to the affected GitLab endpoints without first completing SAML SSO. Because the enforcement check is missing, GitLab processes the request as if the SSO requirement were satisfied. This bypasses identity provider controls such as conditional access, session lifetime, and multi-factor authentication policies enforced at the IdP.
No public proof-of-concept code is available. Technical details are tracked in GitLab Work Item 603742 and HackerOne Report #3745561.
Detection Methods for CVE-2026-12910
Indicators of Compromise
- Successful access to SSO-restricted group resources by users without a corresponding SAML assertion event at the identity provider.
- Audit log entries showing GitLab API or web activity against SSO-enforced groups from sessions that never triggered a SAML authentication flow.
- Discrepancies between GitLab session activity and IdP sign-in logs for the same user account within overlapping time windows.
Detection Strategies
- Correlate GitLab authentication and audit logs with SAML IdP sign-in logs to identify GitLab sessions that access SSO-restricted resources without a matching IdP authentication.
- Alert on access to group-restricted resources by user accounts that have never completed a SAML assertion for that group.
- Baseline expected SSO flow volumes per group and flag negative deviations that indicate users bypassing the enforced flow.
Monitoring Recommendations
- Ingest GitLab audit events and IdP authentication logs into a centralized analytics platform for cross-source correlation.
- Monitor group membership and permission changes on SSO-enforced groups during the exposure window.
- Review API token and personal access token usage against SSO-enforced groups, since token-based access is a common bypass surface for SSO controls.
How to Mitigate CVE-2026-12910
Immediate Actions Required
- Upgrade GitLab CE/EE to version 19.1.8, 19.2.6, or 19.3.2 or later depending on the deployed branch.
- Audit access to SAML SSO-enforced groups during the exposure window and confirm each session against IdP sign-in records.
- Rotate personal access tokens, deploy tokens, and API tokens associated with users in SSO-restricted groups if bypass activity is suspected.
Patch Information
GitLab has remediated the issue in GitLab CE/EE versions 19.1.8, 19.2.6, and 19.3.2. Administrators running any release from 18.6 up to these fixed versions should upgrade immediately. Refer to GitLab Work Item 603742 for the vendor's remediation record.
Workarounds
- No official workaround has been published; upgrading to a fixed version is the recommended remediation.
- Where immediate upgrade is not possible, restrict network access to the GitLab instance to trusted networks and require VPN or zero-trust gateway authentication in front of GitLab.
- Review and tighten group membership on SSO-enforced groups to minimize the population of users capable of exercising the bypass.
# Verify the running GitLab version before and after upgrade
sudo gitlab-rake gitlab:env:info | grep -i "GitLab information" -A 5
# Example upgrade commands (Omnibus package)
sudo apt-get update && sudo apt-get install gitlab-ee=19.3.2-ee.0
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
