CVE-2026-1338 Overview
CVE-2026-1338 is an authorization bypass vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw allows authenticated users with developer-role permissions to delete protected container registry tags due to improper authorization checks. Affected versions include all GitLab releases from 17.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. The issue is tracked under [CWE-639] (Authorization Bypass Through User-Controlled Key). GitLab remediated the issue in patch release 18.11.3, published on May 13, 2026.
Critical Impact
Authenticated developer-role users can delete protected container registry tags, undermining release integrity and supply chain controls in affected GitLab instances.
Affected Products
- GitLab CE/EE versions 17.10 through 18.9.6
- GitLab CE/EE versions 18.10 through 18.10.5
- GitLab CE/EE versions 18.11 through 18.11.2
Discovery Timeline
- 2026-05-13 - GitLab releases security patch 18.11.3
- 2026-05-14 - CVE-2026-1338 published to NVD
- 2026-05-14 - Last updated in NVD database
Technical Details for CVE-2026-1338
Vulnerability Analysis
The vulnerability resides in GitLab's container registry tag protection logic. Protected container registry tags are intended to enforce immutability or limit deletion to users with elevated permissions, such as maintainers or owners. The authorization check that gates tag deletion did not correctly evaluate the protection status against the requesting user's role. As a result, users assigned the developer role could delete tags that policy designated as protected. The impact is limited to integrity, with no confidentiality or availability impact reported. Successful exploitation requires an authenticated session and developer-level access to the target project, but no user interaction.
Root Cause
The defect is an authorization bypass categorized under [CWE-639]. The container registry tag deletion endpoint failed to consistently enforce the protected-tag policy against the caller's effective role. Authorization decisions relied on an incomplete check that permitted developer-role requests to proceed against resources that should have been restricted to higher-privilege roles.
Attack Vector
An authenticated attacker with developer permissions on a target project issues a delete request against a protected container registry tag through the GitLab API or UI. Because the protection check is improperly evaluated, the deletion succeeds. Attackers can use this to remove signed release tags, replace immutable build artifacts, or disrupt downstream deployment pipelines that pull specific tagged images.
No public proof-of-concept code is available. Technical details are tracked in the GitLab Work Item and the corresponding HackerOne Security Report.
Detection Methods for CVE-2026-1338
Indicators of Compromise
- Unexpected deletion events for container registry tags marked as protected in project audit logs.
- Tag deletion API calls (DELETE /api/v4/projects/:id/registry/repositories/:repo/tags/:tag) originating from developer-role accounts.
- Discrepancies between expected release tags in container repositories and current registry state.
Detection Strategies
- Review GitLab audit events for container_registry_tag_deleted actions and correlate the actor's role with the tag's protection status.
- Compare CI/CD pipeline manifests and deployment records against the current registry contents to surface missing or recreated protected tags.
- Alert on tag deletion volume anomalies, particularly on repositories housing production release artifacts.
Monitoring Recommendations
- Forward GitLab application and audit logs to a centralized logging platform and retain them for forensic review.
- Enable webhook notifications for container registry events on repositories that host production images.
- Track project membership changes that elevate accounts to developer role, especially on repositories with protected tags.
How to Mitigate CVE-2026-1338
Immediate Actions Required
- Upgrade GitLab CE/EE to version 18.9.7, 18.10.6, or 18.11.3, depending on the deployed release branch.
- Audit recent container registry tag deletions and validate that protected production tags remain intact.
- Review and minimize the number of accounts assigned the developer role on projects with protected container tags.
Patch Information
GitLab released fixed versions 18.9.7, 18.10.6, and 18.11.3 on May 13, 2026. Self-managed administrators should follow the upgrade guidance in the GitLab Patch Release Note. GitLab.com SaaS instances are patched by the vendor.
Workarounds
- Restrict developer-role assignments on projects that rely on protected container registry tags until patches are applied.
- Mirror critical container images to an external registry with independent access controls to preserve a recoverable copy.
- Increase audit log review cadence for container registry deletions during the remediation window.
# Verify the installed GitLab version meets the fixed release
gitlab-rake gitlab:env:info | grep "GitLab information" -A 5
# Example upgrade path for Omnibus installations on the 18.11 branch
sudo apt-get update && sudo apt-get install gitlab-ee=18.11.3-ee.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
