Cyber Resilience

CVE-2026-1230

Gitlab 1.0.0 – 18.7.6

Published
11 March 2026
Modified
17 March 2026
Patch / advisory
CVSS Score v3.1 4.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
EPSS Score 0.0019 9th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-1230 is a medium-severity Use of Incorrectly-Resolved Name or Reference (CWE-706) vulnerability in Gitlab Gitlab. Its CVSS base score is 4.1 (Medium).

Operationally, ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-7 (Software, Firmware, and Information Integrity) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 1.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to cause repository downloads to contain different code than displayed in…

more

the web interface due to incorrect validation of branch references under certain circumstances.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

Insufficient information to map techniques.
Confidence: LOW · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-8716Same product: Gitlab Gitlab
CVE-2025-12506Same product: Gitlab Gitlab
CVE-2023-2030Same product: Gitlab Gitlab
CVE-2026-13151Same product: Gitlab Gitlab
CVE-2024-1211Same product: Gitlab Gitlab
CVE-2023-5009Same product: Gitlab Gitlab
CVE-2023-0632Same product: Gitlab Gitlab
CVE-2024-2818Same product: Gitlab Gitlab
CVE-2023-6680Same product: Gitlab Gitlab
CVE-2024-11274Same product: Gitlab Gitlab

Affected Assets

gitlab
gitlab
1.0.0 — 18.7.6 · 1.0.0 — 18.7.6 · 18.8.0 — 18.8.6

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SI-7 Software, Firmware, and Information Integrity
  • AC-3 Access Enforcement
Detect
Catch it (NIST detect / respond)
  • SI-7 Software, Firmware, and Information Integrity
Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation of all inputs including branch references to block incorrect name/reference resolution that produces mismatched download content.

preventdetect

Requires integrity verification mechanisms that would detect or prevent serving different code via download than shown in the web interface.

prevent

Enforces correct mapping of authenticated requests to the intended branch reference, stopping unauthorized or incorrect code retrieval.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure-development practices directly prevent incorrect name/reference resolution bugs during coding.

PR.AA-05 partial match
prevents

Enforced authorization boundaries limit damage from an incorrectly resolved reference.

PR.IR-01 partial match
prevents

Logical segmentation and access controls reduce the chance an out-of-sphere resolution succeeds.

PR.PS-01 partial match
prevents

Hardened configuration baselines can constrain allowable name-to-resource mappings.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing can detect incorrect name or reference resolution through fuzzing and negative test cases.

degrades

Network segmentation and routing policies reduce the chance that a mis-resolved name leads to an unintended external resource.

degrades

Segregated networks limit the blast radius when a name or reference resolves outside the intended control sphere.

prevents

Secure SDLC practices include design reviews that can catch incorrect name or reference handling before deployment.

prevents

Application security requirements can mandate validation of all external references and names used at runtime.

prevents

Secure architecture principles discourage reliance on ambient or globally-resolvable names without explicit scoping.

References