CVE-2026-4527: GitLab CE/EE CSRF Vulnerability

CVE-2026-4527 Overview

CVE-2026-4527 is a Cross-Site Request Forgery (CSRF) vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. Missing CSRF protection allows an unauthenticated attacker to create unauthorized Jira subscriptions for a targeted user's namespace through a specially crafted link. Exploitation requires user interaction, such as clicking a malicious URL while authenticated to GitLab. GitLab patched the issue in version 18.11.3 and corresponding backports on May 13, 2026. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact

An unauthenticated attacker can hijack a user session through a crafted link to create unauthorized Jira subscriptions tied to the victim's namespace, manipulating integration state without consent.

Affected Products

• GitLab CE/EE versions 11.10 through 18.9.6
• GitLab CE/EE versions 18.10 through 18.10.5
• GitLab CE/EE versions 18.11 through 18.11.2

Discovery Timeline

• 2026-05-13 - GitLab releases security patch in versions 18.11.3, 18.10.6, and 18.9.7
• 2026-05-14 - CVE-2026-4527 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-4527

Vulnerability Analysis

The vulnerability resides in the Jira integration subscription endpoint of GitLab CE/EE. The handler responsible for creating Jira subscriptions does not validate an anti-CSRF token on incoming requests. As a result, the server accepts subscription-creation requests originating from any cross-origin context, provided the victim's browser carries valid GitLab session cookies.

An attacker who controls an external page can embed a request that targets the victim's namespace. When the victim visits the attacker-controlled link while authenticated to GitLab, the browser submits the request with session credentials attached. GitLab processes the request as if the victim initiated it and provisions a Jira subscription against the victim's namespace.

The attack requires no privileges on the GitLab instance itself. User interaction is mandatory because the victim must follow the malicious link. Impact is limited to integrity of the Jira integration state for the targeted namespace, with no direct compromise of confidentiality or availability of GitLab data.

Root Cause

The root cause is the absence of CSRF token verification on the Jira subscription creation endpoint. State-changing operations in GitLab generally require a token tied to the user session, but this endpoint was reachable through a request method or path that bypassed the framework's CSRF middleware enforcement.

Attack Vector

Exploitation occurs over the network and requires the victim to interact with attacker-controlled content. The attacker crafts a link or HTML page that triggers a request to the vulnerable Jira subscription endpoint. The victim's authenticated browser issues the request, and GitLab creates the subscription bound to the victim's namespace. No authentication of the attacker is required, and the attacker never observes the victim's credentials.

For technical details, see the GitLab Patch Release Announcement, GitLab Work Item #594339, and HackerOne Report #3590487.

Detection Methods for CVE-2026-4527

Indicators of Compromise

• Unexpected Jira subscription records in GitLab audit logs tied to user namespaces where the user did not initiate the action.
• Requests to Jira integration subscription endpoints with Referer or Origin headers pointing to non-GitLab domains.
• Spikes in Jira subscription creation events correlated with user clicks on external links in email or chat platforms.

Detection Strategies

• Review GitLab audit events for jira_connect_subscription creation entries and correlate them with the originating IP, user agent, and referer.
• Inspect web server and reverse proxy logs for POST or GET requests against Jira subscription endpoints arriving with cross-origin referers.
• Query user activity timelines to confirm whether the namespace owner was actively using GitLab when the subscription was created.

Monitoring Recommendations

• Forward GitLab audit logs to a centralized SIEM and alert on Jira integration changes that occur outside business hours or from unusual locations.
• Establish a baseline of legitimate Jira subscription activity per namespace and flag deviations for investigation.
• Monitor for clusters of subscription events tied to a single attacker-controlled Jira instance URL across multiple victim namespaces.

How to Mitigate CVE-2026-4527

Immediate Actions Required

• Upgrade GitLab CE/EE to version 18.11.3, 18.10.6, or 18.9.7 as appropriate for your deployment branch.
• Audit existing Jira subscriptions across all namespaces and remove any that users did not authorize.
• Notify users of the issue and instruct them to verify integration settings on their namespaces.

Patch Information

GitLab released fixes in versions 18.11.3, 18.10.6, and 18.9.7 on May 13, 2026. The patch adds CSRF token enforcement on the Jira subscription endpoint. Refer to the GitLab Patch Release Announcement for full upgrade instructions and the GitLab Work Item #594339 for the issue tracker entry.

Workarounds

• If immediate patching is not possible, disable the Jira integration at the instance or group level until the upgrade is applied.
• Restrict GitLab access to authenticated users behind a corporate proxy that enforces strict SameSite cookie policies.
• Advise users to log out of GitLab when following links from untrusted sources and to use isolated browser profiles for administrative tasks.