CVE-2026-100104

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.3 through 19.2.7 GitLab CE/EE versions 19.3 through 19.3.4 GitLab CE/EE versions 19.4 through 19.4.1

Description An authenticated user can perform server-side request forgery (SSRF), which allows the attacker to reach internal network resources. This occurs due to a time-of-check to time-of-use (TOCTOU) race condition—a scenario where a system checks a condition (such as a security credential) but the condition changes before the system actually uses the result—during URL validation in repository import operations.

Recommendations Update GitLab CE/EE to version 19.2.8 or later. Update GitLab CE/EE to version 19.3.5 or later. Update GitLab CE/EE to version 19.4.2 or later.