CVE-2026-3855: GitLab Terraform Information Disclosure Flaw

CVE-2026-3855 Overview

CVE-2026-3855 affects GitLab Community Edition (CE) and Enterprise Edition (EE) across multiple release branches. The flaw resides in the Terraform state upload functionality, where improper validation of parameters allows an authenticated user with project-level permissions to access restricted file contents on the server or trigger a denial of service. The issue is classified under CWE-99: Improper Control of Resource Identifiers. GitLab has released patched versions across the 19.1.x, 19.2.x, and 19.3.x branches.

Critical Impact
Authenticated attackers with project-level access can read restricted server-side file contents or cause service disruption via crafted Terraform state upload requests.

Affected Products

GitLab CE/EE versions 18.2.7 up to (but not including) 19.1.8
GitLab CE/EE versions 19.2 up to (but not including) 19.2.6
GitLab CE/EE versions 19.3 up to (but not including) 19.3.2

Discovery Timeline

2026-09-16 - CVE-2026-3855 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-3855

Vulnerability Analysis

The vulnerability exists in GitLab's Terraform state upload endpoint. GitLab exposes an HTTP interface that lets projects push and pull Terraform state files as part of the managed Terraform state backend. The endpoint fails to properly validate parameters supplied by the client during the upload operation. An authenticated user with sufficient project-level permissions can abuse this weakness to instruct the server to interact with resource identifiers it should not process.

The outcome depends on how the attacker crafts the request. In one path, the server returns or exposes contents of restricted files it can read on the underlying host. In another path, the malformed parameter causes resource exhaustion or an unhandled condition that disrupts availability.

Root Cause

The root cause is improper control of a resource identifier (CWE-99) within the Terraform state upload handler. User-controlled parameters flow into resource resolution logic without adequate validation or normalization. This allows the identifier to reference resources outside the intended scope of the state storage operation.

Attack Vector

Exploitation requires network access to the GitLab instance and a valid authenticated session with project-level permissions. The attacker sends a crafted Terraform state upload request containing a malicious parameter value. The high attack complexity reflects specific preconditions that must be met for successful exploitation. No user interaction is required. Refer to the HackerOne Report #3575167 and GitLab Work Item #592821 for coordinated disclosure details.

Detection Methods for CVE-2026-3855

Indicators of Compromise

Unexpected HTTP PUT or POST requests to Terraform state endpoints under /api/v4/projects/*/terraform/state/* containing anomalous parameter values or unusual path characters.
GitLab application logs showing repeated 4xx or 5xx responses from the Terraform state controller tied to a single authenticated user.
Sudden resource exhaustion, worker crashes, or Sidekiq job failures correlated with Terraform state upload activity.

Detection Strategies

Review GitLab production_json.log and api_json.log for Terraform state upload requests with malformed parameters or non-standard resource identifiers.
Baseline normal Terraform state upload behavior per project and alert on statistical outliers in request size, frequency, or parameter shape.
Correlate authenticated user actions with unexpected file read patterns on the GitLab application server.

Monitoring Recommendations

Enable audit logging for project-level Terraform state operations and forward events to a centralized SIEM.
Monitor GitLab instance CPU, memory, and worker queue depth for anomalies coinciding with Terraform state API traffic.
Track authenticated user API token usage to detect credential abuse against Terraform endpoints.

How to Mitigate CVE-2026-3855

Immediate Actions Required

Upgrade GitLab CE/EE to version 19.1.8, 19.2.6, or 19.3.2 or later, depending on your current release branch.
Audit project membership and remove unnecessary project-level permissions to reduce the pool of users who can reach the vulnerable endpoint.
Rotate personal access tokens and CI/CD tokens for accounts that exhibited suspicious Terraform state activity.

Patch Information

GitLab has released fixed builds addressing CVE-2026-3855. Consult the GitLab Patch Release Note for 19.3.2 for the full changelog and upgrade instructions. Self-managed operators should apply the corresponding patch for their active release branch. GitLab.com SaaS tenants are patched by the vendor.

Workarounds

If immediate patching is not feasible, restrict access to the Terraform state API at the reverse proxy or web application firewall layer.
Temporarily disable the managed Terraform state feature for projects that do not require it while the upgrade is planned.
Enforce stricter role-based access control so only trusted maintainers hold project-level permissions that permit Terraform state uploads.

bash

# Example NGINX snippet to block Terraform state endpoints pending patch
location ~ ^/api/v4/projects/.*/terraform/state/ {
    return 403;
}