Introduction
A long-standing input validation gap in GitLab's CI/CD job update API has exposed self-managed instances to unauthenticated denial-of-service attacks since version 9.0. GitLab patched the issue on May 13, 2026. The vulnerable code path had been present for many years, so the population of affected installations is substantial.
CVE-2026-1659 carries a CVSS 3.1 score of 7.5. Exploiting it requires no authentication, no user interaction, and only low attack complexity. For organizations running internet-facing GitLab instances, that combination makes prompt patching a clear priority.
Technical information
The vulnerability is in GitLab's CI/CD job update API, a component that has been present since version 9.0. The root cause is insufficient input validation, classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The application does not properly restrict the size or amount of resources an actor can request, so specially crafted requests can exhaust system resources and put the instance into a denial-of-service state.
The CVSS 3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. It breaks down as follows:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality / Integrity Impact: None
- Availability Impact: High
Based on the advisory details, the attack proceeds as follows:
- An attacker identifies a network-reachable GitLab instance running any version from 9.0 up to the patched releases.
- The attacker sends specially crafted requests to the CI/CD job update API endpoint.
- Because the endpoint lacks proper bounds checking and resource allocation constraints, these requests cause unchecked resource consumption on the server.
- The result is a denial-of-service condition that degrades or eliminates availability of the GitLab instance and disrupts CI/CD pipelines and engineering workflows.
No authentication is required, so any internet-facing GitLab instance exposes this API endpoint to anonymous attackers. The low attack complexity means no specialized conditions or preparation are needed to trigger the vulnerability.
The specific payload structures and proof-of-concept details have not been publicly disclosed. The HackerOne report (#3519824) and GitLab's internal issue tracker entry (work item #588201) remain confidential, consistent with GitLab's standard practice of making security issues public 30 days after the patch release.
Patch information
GitLab fixed CVE-2026-1659 in a coordinated patch release published on May 13, 2026. The fixes ship across three supported release branches, 18.11.3, 18.10.6, and 18.9.7, and cover both Community Edition (CE) and Enterprise Edition (EE).
The fix tightens input validation in the CI/CD job update API handler. The patch adds proper bounds checking and resource allocation constraints to the API's request processing logic, which directly prevents the unchecked resource consumption that crafted requests could trigger.
| Branch | Affected Range | Fixed Version |
|---|---|---|
| 18.11 | 18.11.0 up to versions before 18.11.3 | 18.11.3 |
| 18.10 | 18.10.0 up to versions before 18.10.6 | 18.10.6 |
| 9.0 to 18.9 | 9.0.0 up to versions before 18.9.7 | 18.9.7 |
GitLab.com (the SaaS offering) was already running the patched version when the release was announced. GitLab Dedicated customers did not need to take manual action. Self-managed installations must upgrade to one of the fixed versions listed above.
GitLab's documentation mentions no official workarounds. Upgrading is the only vendor-documented remediation.
Security teams should prioritize the rollout by exposure: internet-facing production instances first, then internal production, then lower environments. The same release also fixes other recently disclosed vulnerabilities, including high-severity cross-site scripting (XSS) flaws, so applying these patches protects systems against those as well.
Affected systems and versions
The vulnerability affects all GitLab CE/EE versions from 9.0 onward that have not been updated to one of the fixed releases:
- GitLab CE/EE versions 9.0.0 through 18.9.6 (fixed in 18.9.7)
- GitLab CE/EE versions 18.10.0 through 18.10.5 (fixed in 18.10.6)
- GitLab CE/EE versions 18.11.0 through 18.11.2 (fixed in 18.11.3)
The vulnerable component is the CI/CD job update API endpoint. Any self-managed GitLab instance that runs a version in the affected ranges and is reachable over the network is exposed. GitLab has already patched GitLab.com and GitLab Dedicated instances.
Vendor security history
GitLab maintains a mature security program. The company acts as its own CVE Numbering Authority (CNA), which gives it direct control over vulnerability disclosure timelines. GitLab has run a public bug bounty program on HackerOne since February 2016. It pays $1,000 for critical or high-severity reports at the time of triage and uses a public CVSS calculator to determine final bounty amounts.
Researcher "a92847865" found CVE-2026-1659 through this program and reported it in HackerOne report #3519824. The May 13, 2026 patch release that fixed it also resolved other high-severity flaws, including cross-site scripting (XSS) vulnerabilities. Bundling security fixes into coordinated releases is standard practice at GitLab.
GitLab was named a Leader in the 2025 Gartner Magic Quadrant for DevOps Platforms for the third consecutive year, and it ranked number one in four out of six use cases in the accompanying Critical Capabilities report.
