CVE-2026-6336 Overview
CVE-2026-6336 is a missing authorization vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1. Under certain conditions, an unauthorized user can view project import source information because the application fails to perform an authorization check on the relevant endpoint. The issue is classified under CWE-863: Incorrect Authorization and is exploitable over the network without authentication or user interaction.
Critical Impact
An unauthenticated remote attacker can enumerate project import source information from affected GitLab instances, exposing details about external repositories used as import sources.
Affected Products
- GitLab CE/EE versions 16.6 through 19.0.4
- GitLab CE/EE versions 19.1 through 19.1.2
- GitLab CE/EE versions 19.2 through 19.2.0
Discovery Timeline
- 2026-07-29 - CVE-2026-6336 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-6336
Vulnerability Analysis
The vulnerability resides in GitLab's project import functionality. GitLab supports importing projects from external sources such as GitHub, Bitbucket, and other Git providers. The metadata describing these import sources should be restricted to authorized users associated with the project.
GitLab omitted an authorization check on the endpoint returning project import source information. As a result, requests reach the data-return path without verifying the caller's project role or membership. An attacker sending a crafted request can retrieve import source details that should only be visible to authorized project members.
The defect is an information disclosure issue with no impact on integrity or availability. Confidentiality impact is limited to import source metadata rather than repository contents or credentials.
Root Cause
The root cause is a missing authorization check ([CWE-863]) in the controller or service handling project import source lookups. The code path returns data to the requester without validating that the requester holds the required role on the target project. Authentication state and project visibility settings are not enforced consistently for this specific data field.
Attack Vector
Exploitation requires only network access to the GitLab instance. No authentication or user interaction is needed. An attacker issues HTTP requests to the affected endpoint referencing target project identifiers and reads the returned import source information. Publicly reachable GitLab servers, including self-hosted instances exposed to the internet, are directly reachable by anonymous attackers.
Technical details are documented in the HackerOne Report #3661988 and the GitLab Work Item Description.
Detection Methods for CVE-2026-6336
Indicators of Compromise
- Unauthenticated HTTP requests to GitLab project import-related API endpoints originating from unexpected IP ranges or automated scanners.
- Repeated enumeration patterns iterating over sequential project IDs or namespaces from a single client.
- Elevated 200-response rates on import source endpoints for anonymous sessions in web server or reverse proxy logs.
Detection Strategies
- Review GitLab production_json.log and api_json.log for anonymous requests that successfully retrieved project import source data.
- Correlate requests to import-related routes against session authentication state to identify unauthenticated access.
- Deploy web application firewall (WAF) rules that flag unauthenticated access attempts to project metadata endpoints on GitLab.
Monitoring Recommendations
- Ingest GitLab application and audit logs into a centralized SIEM and alert on anonymous access to project APIs.
- Track request volume baselines per endpoint and alert on anomalous spikes targeting import-related routes.
- Monitor egress from GitLab hosts to detect follow-on reconnaissance against disclosed import source systems.
How to Mitigate CVE-2026-6336
Immediate Actions Required
- Upgrade GitLab CE/EE to version 19.0.5, 19.1.3, 19.2.1, or later depending on your release branch.
- Inventory all self-managed GitLab instances, including those in development and staging environments, and prioritize internet-exposed hosts.
- Review access logs for the period preceding the patch to identify potential exposure of import source data.
Patch Information
GitLab addressed the issue in versions 19.0.5, 19.1.3, and 19.2.1. Patch details and upgrade guidance are provided in the GitLab Release Patch Note. GitLab.com SaaS instances are patched by the vendor. Self-managed administrators should apply the corresponding upgrade for their release branch.
Workarounds
- Restrict network access to GitLab instances using firewall rules, VPN, or IP allowlists until the upgrade is applied.
- Place GitLab behind an authenticating reverse proxy that blocks anonymous requests to API paths.
- Reduce project visibility to private for repositories where import source metadata is sensitive.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
