CVE-2026-7767

URL Redirection to Untrusted Site ('Open Redirect') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to an unintended server due to improper redirect validation in the Kubernetes proxy.

Affected

GitLab

CVSS v3.1 GITLAB

5.8 MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

EPSS

0.29% chance of exploitation in the next 30 days, 21st percentile

Published

2026-10-13

Updated

2026-10-14

Proof-of-concept exploits (1)

• https://hackerone.com/reports/3597095

Security advisories

• https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released
• https://gitlab.com/gitlab-org/gitlab/-/work_items/598965

References

• CVE Record
• NVD entry