CVE-2026-3074: GitLab Information Disclosure Vulnerability

CVE-2026-3074 Overview

CVE-2026-3074 is an improper access control vulnerability [CWE-639] in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions from 16.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. An authenticated low-privilege user can download private debugging symbols from projects they should not be able to access. The issue stems from missing authorization checks on the debug symbol download endpoint. GitLab remediated the issue in patch release 18.11.3 and corresponding backport versions.

Critical Impact

Low-privileged users can retrieve private debugging symbols from inaccessible projects, exposing internal code structure and sensitive build artifacts.

Affected Products

• GitLab CE/EE versions 16.7 through 18.9.6
• GitLab CE/EE versions 18.10 through 18.10.5
• GitLab CE/EE versions 18.11 through 18.11.2

Discovery Timeline

• 2026-05-13 - GitLab releases patched versions 18.11.3, 18.10.6, and 18.9.7
• 2026-05-14 - CVE-2026-3074 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-3074

Vulnerability Analysis

The vulnerability resides in the GitLab endpoint responsible for serving debugging symbol artifacts. The endpoint fails to enforce project-level authorization before returning symbol files. As a result, any authenticated user can request debug symbols belonging to private projects they are not a member of.

Debug symbols frequently contain function names, file paths, build environment metadata, and references to internal libraries. Exposure of this data assists attackers in reconstructing application logic, mapping internal infrastructure, and crafting targeted follow-on attacks against the same codebase.

The issue is classified under [CWE-639] Authorization Bypass Through User-Controlled Key, indicating that the resource identifier alone determined access rather than a permission check tied to the requesting user.

Root Cause

The root cause is a missing access control check on the debug symbol download path. The handler validates that the user is authenticated and that the requested artifact exists, but does not verify membership or visibility scope on the parent project. Private artifacts therefore behave as if they were public to any logged-in account.

Attack Vector

An attacker requires a valid GitLab account on the target instance. The attacker enumerates or guesses project identifiers and requests debug symbol artifacts directly through the API or web interface. No user interaction from a victim is required, and the attack is performed remotely over the network. The disclosed information is limited to debug symbol files, with no direct integrity or availability impact on the GitLab instance.

The vulnerability mechanism is described in the GitLab Work Item Details and the HackerOne Security Report #3556163.

Detection Methods for CVE-2026-3074

Indicators of Compromise

• Unexpected HTTP GET requests to debug symbol download endpoints from accounts with no project membership relationship to the targeted project.
• High volume of sequential project ID enumeration against symbol artifact paths from a single authenticated session.
• Authenticated downloads of symbol files originating from IP addresses or user agents not associated with normal developer activity.

Detection Strategies

• Review GitLab production logs and audit events for symbol download requests, correlating the requesting user against project membership records.
• Alert on authenticated users accessing artifacts across an abnormally large number of distinct private projects in a short window.
• Hunt for service accounts or low-privilege users issuing requests to symbol endpoints outside their normal project scope.

Monitoring Recommendations

• Forward GitLab production_json.log and audit_json.log to a centralized logging platform for retention and correlation.
• Track per-user download counts for package and symbol artifacts and baseline normal activity.
• Monitor for the appearance of the GitLab version banner in HTTP responses to confirm patched versions are deployed across all instances.

How to Mitigate CVE-2026-3074

Immediate Actions Required

• Upgrade GitLab CE/EE to version 18.11.3, 18.10.6, or 18.9.7 as applicable to your release branch.
• Audit recent symbol download activity for any unauthorized cross-project access by low-privilege accounts.
• Restrict new account self-registration on internet-facing GitLab instances until patching is complete.

Patch Information

GitLab released fixed versions on May 13, 2026. Administrators should apply 18.11.3, 18.10.6, or 18.9.7 depending on the deployed branch. Details are available in the GitLab Patch Release Announcement.

Workarounds

• No official workaround replaces patching. If immediate upgrade is not possible, limit account creation and review existing low-privilege users.
• Place the GitLab instance behind a reverse proxy or WAF rule that blocks unauthenticated and low-trust sessions from accessing symbol artifact paths.
• Temporarily disable the debug symbol package feature for affected projects if it is not in active use.

# Verify installed GitLab version after upgrade
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5

# Example: confirm running version meets the patched baseline
gitlab-ctl status
/opt/gitlab/embedded/service/gitlab-rails/VERSION