CVE-2026-3160
Gitlab 13.7.0 – 18.9.7
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:NSummary
CVE-2026-3160 is a medium-severity Confused Deputy (CWE-441) vulnerability in Gitlab Gitlab. Its CVSS base score is 5.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Information Repositories (T1213); ranked at the 13th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-30226
Vulnerability Data
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to view Jira issues outside the configured project scope due to…
more
an integration filter functioning only as a display control rather than enforcing access boundaries as specified.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables unauthorized access to Jira issues (information repository) by bypassing intended access control filters in the integration.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces that the Jira integration filter must act as an access boundary rather than a mere display control, blocking authenticated users from viewing issues outside the configured project scope.
Enforces information flow rules between GitLab and Jira so that only project-scoped issues are retrievable, addressing the proxy-like leakage described in CWE-441.
Ensures the integration is configured with the minimum privileges needed for the declared project scope, reducing the impact of any filter-enforcement failure.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper conveyance and verification of original identity assertions directly prevents loss of request source when forwarding.
Enforcing least-privilege authorizations on forwarded requests reduces confused-deputy abuse even if source identity is lost.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Access-control rules can limit which upstream identities may cause the product to act on their behalf, reducing confused-deputy risk.
Proper identity management ensures the original requester identity is preserved and validated before the product forwards requests.
Explicit access-rights assignment can restrict the product’s ability to act as an unintended proxy for external actors.
Privileged-access controls limit the rights the product may exercise on behalf of upstream callers, mitigating confused-deputy abuse.
Network-security controls can enforce source validation and prevent the product from blindly proxying traffic to external actors.
Secure-SDLC practices include design reviews that detect and eliminate confused-deputy proxy patterns before deployment.