CVE-2026-3035

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were not authorized to use due to improper authorization checks.

• CWE-288

• https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/Release Notes, Vendor Advisory
• https://gitlab.com/gitlab-org/gitlab/-/work_items/591189Issue Tracking, Vendor Advisory
• https://hackerone.com/reports/3529751Permissions Required, Third Party Advisory

Published

Aug 26, 2026

Last Modified

Aug 31, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30313DSAI-Cline's command auto-approval module contains a critica…9.8
• CVE-2026-30314Ridvay Code's command auto-approval module contains a critic…9.8
• CVE-2026-30332A Time-of-Check to Time-of-Use (TOCTOU) race condition vulne…7.5
• CVE-2026-3034The OoohBoi Steroids for Elementor plugin for WordPress is v…6.4
• CVE-2026-30345A zip slip vulnerability in the Admin import functionality o…7.5
• CVE-2026-30346An open redirect in the /api/google/authorize endpoint of hu…4.3
• CVE-2026-30350An issue in the /store/items/search endpoint of Agent Protoc…7.5
• CVE-2026-30351A path traversal vulnerability in the UI/static component of…7.5
• CVE-2026-30352A remote code execution (RCE) vulnerability in the /devserve…9.8
• CVE-2026-30363flipperzero-firmware commit ad2a80 was discovered to contain…8.4
• CVE-2026-30364CentSDR commit e40795 was discovered to contain a stack over…7.5
• CVE-2026-30368A client-side authorization flaw in Lightspeed Systems Class…5.4