CVE-2026-92628

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context.

• CWE-362

• https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/Release Notes, Vendor Advisory
• https://gitlab.com/gitlab-org/gitlab/-/work_items/621933Issue Tracking

Published

Sep 24, 2026

Last Modified

Sep 28, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92619The Booking Calendar plugin for WordPress is vulnerable to P…7.2
• CVE-2026-9262Use of a non-secure protocol as the default FTP configuratio…7.5
• CVE-2026-92622The Strong Testimonials plugin for WordPress is vulnerable t…6.4
• CVE-2026-92625Control iD iDSecure versions prior to 4.8.3.0 are affected b…7.5
• CVE-2026-92626Control iD iDSecure versions prior to 4.8.3.0 are affected b…7.5
• CVE-2026-92627A heap-use-after-free vulnerability exists in H5T__conv_f_f(…4.6
• CVE-2026-92629A potential improper authorization vulnerability was reporte…7.3
• CVE-2026-9263The Zephyr Bluetooth controller ISO Adaptation Layer (subsys…8.1
• CVE-2026-9264A cross-site scripting (XSS) vulnerability in SketchUp 2026'…9.3
• CVE-2026-9265Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits…9.1
• CVE-2026-9266A Missing Required Cryptographic Step vulnerability has been…7
• CVE-2026-92665Dell PowerProtect Data Domain, Feature Release versions 7.7.…5.3