CVE-2026-7767
Last modified
CVE-2026-7767 is a medium-severity vulnerability rated 5.8/10 on the CVSS scale. GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to an unintended server due to improper redirect validation in the Kubernetes proxy.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to an unintended server due to improper redirect validation in the Kubernetes proxy.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 13.11.0, < 19.2.8 |
| Gitlab | Gitlab | >= 19.3.0, < 19.3.5 |
| Gitlab | Gitlab | >= 19.4.0, < 19.4.2 |
References
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/598965Issue Tracking
- https://hackerone.com/reports/3597095Permissions Required
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-7767?
How severe is CVE-2026-7767?
How do I fix CVE-2026-7767?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-77650The append-only-vec crate 0.1.9 for Rust can trigger executi…9.8
- CVE-2026-77651The arrayref crate 0.3.10 for Rust can trigger execution of …9.8
- CVE-2026-77652A heap-based buffer overflow vulnerability exists in the Dia…7.8
- CVE-2026-77654Improper Privilege Management vulnerability in Horizon Secur…6.1
- CVE-2026-77658A stack-based buffer overflow vulnerability exists in the Di…7.8
- CVE-2026-7766Kenik Camera management Panel is vulnerable to Path Traversa…8.3
- CVE-2026-7768@fastify/accepts-serializer cached serializer-selection resu…7.5
- CVE-2026-77680An algorithmic complexity flaw exists in libsoup's HTTP Rang…5.3
- CVE-2026-77681A vulnerability was identified in CodeAstro Online Job Porta…6.3
- CVE-2026-77683A security flaw has been discovered in Comfast CF-N1-S 2.6.0…9.9
- CVE-2026-77684The Bluetooth Classic Hands-Free Profile HF role in subsys/b…5.7
- CVE-2026-77686A weakness has been identified in Dolibarr up to 23.0.4. Thi…5.4
Are you affected by CVE-2026-7767?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST