GitLab Patches Critical Authentication and Denial-of-Service Flaws

GitLab, one of the world’s most widely used DevSecOps platforms, has issued emergency security updates to address a high-severity vulnerability that could allow attackers to bypass two-factor authentication (2FA), alongside several other serious flaws capable of disrupting services through denial-of-service (DoS) attacks. The disclosures underscore persistent challenges in securing software supply chains and developer infrastructure increasingly targeted by cybercriminals and nation-state actors alike.

At the center of the latest advisory is a high-severity authentication bypass vulnerability, tracked as CVE-2026-0723 , affecting both GitLab Community Edition (CE) and Enterprise Edition (EE). According to GitLab, the flaw arises from an unchecked return value within its authentication services. Under specific conditions, an attacker who already knows a victim’s account or credential identifier could exploit this weakness to circumvent GitLab’s two-factor authentication safeguards.

While the exploit requires prior knowledge of internal account identifiers, security experts warn that such information is often easier to obtain than organizations assume. Credential IDs can be exposed through prior breaches, misconfigured logs, insider threats, or through vulnerabilities in interconnected systems. As a result, even a partial bypass of 2FA—a control widely regarded as a cornerstone of modern account security—represents a significant risk, particularly for platforms hosting sensitive source code, CI/CD pipelines, and proprietary intellectual property.

In addition to the authentication flaw, GitLab patched two other high-severity vulnerabilities— CVE-2025-13927 and CVE-2025-13928 —that could allow unauthenticated attackers to trigger denial-of-service conditions. These issues stem from malformed authentication data and improper authorization validation in certain API endpoints, respectively.

GitLab also addressed two medium-severity DoS vulnerabilities. One involves malformed Wiki documents that bypass cycle detection mechanisms ( CVE-2025-13335 ), while another enables resource exhaustion through repeated malformed SSH authentication requests ( CVE-2026-1102 ). Though rated lower in severity, such vulnerabilities can still be leveraged in coordinated attacks, particularly against publicly exposed or poorly monitored instances.

To mitigate the risks, GitLab has released patched versions 18.8.2, 18.7.2, and 18.6.4 for both CE and EE deployments. The company strongly urged administrators of self-managed installations to apply the updates immediately.

The company added that GitLab.com is already running the patched software and that GitLab Dedicated customers are not required to take action.

The urgency of the advisory is amplified by the platform’s extensive exposure on the public internet. According to the nonprofit Internet security monitoring group Shadowserver, nearly 6,000 GitLab Community Edition instances are currently accessible online. Meanwhile, data from the engine Shodan suggests that more than 45,000 devices worldwide carry a detectable GitLab fingerprint. While not all of these systems are necessarily vulnerable or unpatched, such figures highlight the scale of potential risk should attackers weaponize the disclosed flaws.

The latest disclosures are not an isolated incident. In June 2025, GitLab patched multiple high-severity vulnerabilities, including account takeover and missing authentication issues, again urging customers to upgrade without delay. Security researchers have increasingly pointed to DevOps platforms as attractive targets due to their central role in software development, deployment, and credential management.

Attacks against developer infrastructure can have an outsized impact. Compromising a CI/CD platform doesn’t just expose data—it can enable attackers to inject malicious code directly into trusted software supply chains.

These concerns echo broader industry warnings following high-profile supply chain attacks, such as the SolarWinds breach and subsequent incidents involving code repositories, package managers, and build systems. As organizations race to automate development and deployment, security controls often lag behind operational demands.

Founded as an open-source alternative to proprietary development tools, GitLab has grown into a central pillar of modern DevSecOps. The company says its platform serves more than 30 million registered users and is relied upon by over half of the Fortune 100 , including Nvidia, Airbus, T-Mobile, Lockheed Martin, Goldman Sachs, and UBS.

That level of adoption makes GitLab a high-value target. A successful exploit against even a fraction of its user base could expose sensitive source code, intellectual property, and production credentials across multiple industries—from finance and telecommunications to defense and aerospace.

While GitLab’s rapid patching reflects mature vulnerability response practices, the episode also highlights a shared responsibility between vendors and customers. Security experts continue to emphasize the importance of timely patching, minimizing public exposure, enforcing least-privilege access, and monitoring authentication logs for anomalies.

As development platforms become more powerful and interconnected, the margin for error continues to shrink. The latest GitLab vulnerabilities serve as a reminder that even security-focused tools are not immune—and that vigilance, both technical and organizational, remains essential in safeguarding the modern software ecosystem.

This FREE tool below lets you use your own environment data to see exactly what Identity Dark Matter is costing you today and how much time you can reclaim through total observability 👇🏻