CVE-2026-12635

LowCVSS 3.1/10Last modified Jun 26, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to make requests to internal network resources through mirror synchronization due to improper URL validation.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-350

Affected software

VendorProductVersions
GitLabGitLab>= 8.3, < 18.11.6; >= 19.0, < 19.0.3; >= 19.1, < 19.1.1

References

Timeline

Published
Jun 25, 2026
Last modified
Jun 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1263505.9Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI CVE-2026-1263515.9Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. Prior to 2.9.1, Addressable:CVE-2026-1263525.9Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI CVE-2026-1263535.9Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI CVE-2026-1263544.8Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, AddrCVE-2026-1263555.3Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, csrf() limits origin validation to tCVE-2026-1263565.3Hono is a Web application framework that provides support for any JavaScript runtime. From 4.5.1 until 4.13.16, validator('form') uses a strCVE-2026-1263575.3Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, mount() and app.mount() can remove aCVE-2026-1263585.3Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter can omit wildcaCVE-2026-1263593.4Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css CVE-2026-1263605.3OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extract() in openteleCVE-2026-1263612.3Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML aft
CVE-2026-12635: Low severity, CVSS 3.1 | Vulnix