CVE-2026-7471— Server-Side Request Forgery (SSRF) in GitLab
Possible ATT&CK Techniques 2AI
T1071 · Application Layer Protocol T1590 · Gather Victim Network InformationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-7471
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Server-Side Request Forgery (SSRF) in GitLab
Source: NVD (National Vulnerability Database)
Vulnerability Description
GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with control of a virtual registry upstream to make requests to internal hosts due to improper validation.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
服务端请求伪造(SSRF)
Source: NVD (National Vulnerability Database)
Vulnerability Title
GitLab 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
GitLab是美国GitLab公司的一个端到端软件开发平台，具有内置的版本控制、问题跟踪、代码审查、CI/CD（持续集成和持续交付）等功能。 GitLab EE 18.9.7之前版本、18.10.6之前版本和18.11.3之前版本存在代码问题漏洞，该漏洞源于验证不当，可能导致控制虚拟注册表上游的经过身份验证的用户向内部主机发起请求。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-7471
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-7471
请登录查看更多情报信息。
Same Patch Batch · GitLab · 2026-05-14 · 24 CVEs total
| CVE-2026-7481 | 8.7 HIGH | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Gi |
| CVE-2026-7377 | 8.7 HIGH | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Gi |
| CVE-2026-6073 | 8.7 HIGH | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Gi |
| CVE-2025-14869 | 7.5 HIGH | Improper Validation of Specified Quantity in Input in GitLab |
| CVE-2025-14870 | 7.5 HIGH | Allocation of Resources Without Limits or Throttling in GitLab |
| CVE-2026-1659 | 7.5 HIGH | Allocation of Resources Without Limits or Throttling in GitLab |
| CVE-2026-1322 | 6.8 MEDIUM | Business Logic Errors in GitLab |
| CVE-2026-1184 | 6.5 MEDIUM | Deserialization of Untrusted Data in GitLab |
| CVE-2026-8280 | 6.5 MEDIUM | Allocation of Resources Without Limits or Throttling in GitLab |
| CVE-2026-4524 | 6.5 MEDIUM | Authentication Bypass Using an Alternate Path or Channel in GitLab |
| CVE-2026-4527 | 6.5 MEDIUM | Cross-Site Request Forgery (CSRF) in GitLab |
| CVE-2026-3160 | 5.8 MEDIUM | Unintended Proxy or Intermediary ('Confused Deputy') in GitLab |
| CVE-2025-12669 | 5.4 MEDIUM | Improper Control of Generation of Code ('Code Injection') in GitLab |
| CVE-2026-6335 | 5.4 MEDIUM | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Gi |
| CVE-2026-8144 | 4.3 MEDIUM | Missing Authorization in GitLab |
| CVE-2026-6063 | 4.3 MEDIUM | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-3607 | 4.3 MEDIUM | Access Control Check Implemented After Asset is Accessed in GitLab |
| CVE-2026-3074 | 4.3 MEDIUM | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-3073 | 4.3 MEDIUM | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-1338 | 4.3 MEDIUM | Authorization Bypass Through User-Controlled Key in GitLab |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: GitLab
- CVE-2025-12669
Improper Control of Generation of Code ('Code Injection') in - CVE-2025-13874
Authorization Bypass Through User-Controlled Key in GitLab - CVE-2025-14869
Improper Validation of Specified Quantity in Input in GitLab - CVE-2025-14870
Allocation of Resources Without Limits or Throttling in GitL - CVE-2026-1184
Deserialization of Untrusted Data in GitLab
Same vendor: GitLab
- CVE-2025-12669
Improper Control of Generation of Code ('Code Injection') in - CVE-2025-13874
Authorization Bypass Through User-Controlled Key in GitLab - CVE-2025-14869
Improper Validation of Specified Quantity in Input in GitLab - CVE-2025-14870
Allocation of Resources Without Limits or Throttling in GitL - CVE-2026-1184
Deserialization of Untrusted Data in GitLab
Same weakness: CWE-918
- CVE-2026-8725
CoreWorxLab CAAL test-hass Endpoint webhooks.py server-side - CVE-2026-45338
Open WebUI: SSRF via OAuth Profile Picture URL in _process_p - CVE-2026-45347
Open WebUI: Blind server side request forgery (SSRF) via the - CVE-2026-45400
Open WebUI: Server-Side Request Forgery (SSRF) bypass in `va - CVE-2026-45401
Open WebUI: SSRF Bypass via HTTP Redirect Following in Web-F
V. Comments for CVE-2026-7471
No comments yet