project
GitLab is a web-based DevOps platform offering Git repository hosting, CI/CD pipelines, issue tracking, and AI-assisted code review (Duo) for software teams.
No evidence-backed relationships are recorded.
NVD logged CVEs for four MCP servers in about 35 hours, each because every tool it exposes needs no authentication. A fifth MCP flaw, LiteLLM's authentication bypass, is already on CISA's exploited-vulnerabilities list.
Reality
OpenAI has fixed a Critical Codex flaw in which a semicolon in a branch name leaked the agent's GitHub OAuth token on all four Codex surfaces. How far one leaked token could reach was set by its scope, which is chosen by whoever provisions the agent.
Reality
GitLab patched CVE-2026-90970, a sandbox escape that lets any authenticated Duo Agent Platform user run arbitrary commands on a self-hosted AI Gateway. Customers on GitLab's hosted gateway are already protected, so the upgrade falls to Self-Managed shops that run their own.
Perspective Coverage
4 publishersReality
GitLab's September 10 patch release closes CVE-2026-85706, a CVSS 10.0 path confinement failure in the repository commits API. GitLab.com was already patched, so the exposure sits with self-managed servers.
Perspective Coverage
3 publishersReality
Bitbucket Cloud's API tokens, which replace app passwords removed on 28 July 2026, expire after one year with no extension, a dev.to migration guide says. Teams that switch in July 2026 have set their next credential failure for July 2027 unless someone owns token rotation.
Reality
OpenAI's Codex now builds a project's environment once and starts each cloud task from it, with task state recoverable for up to seven days. For a team rolling it out, the new job is deciding who may edit the shared setup and what it can reach.
Reality
Kaniko's community fork, with cross-stage cache lookahead, ran 1.6x slower than BuildKit on GitLab.com runners in a dev.to benchmark. The 15x gap still quoted against kaniko dates from 2018, so teams choosing an in-cluster builder need figures from their own Dockerfiles.
Reality
GitLab's v19.5 docs send AI reviews started by Duo Enterprise seat holders to the single-pass reviewer that reads only the merge request and its diffs. To check cross-file rules on every review, a group Owner has to move seat holders onto the credit-billed Code Review Flow.
Reality
Aikido found a dozen live GitLab 'email work item' addresses in public docs, each carrying a long-lived token that lets any mailbox act as its owner. GitLab calls it intended behavior, so maintainers must pull the address and reset the token.
Perspective Coverage
3 publishersReality
WatchTowr reproduced CVE-2026-19478 from the advisory and patch alone, then caught the first exploitation attempts on its honeypots. Self-managed owners do not get a week to schedule this.
Perspective Coverage
7 publishersReality
Five US agencies report attackers scanning for exposed S7 PLCs and using a public library to read and write data blocks. The mitigation list reads like a commissioning checklist.
Reality
Rapid7 published a Metasploit module for CVE-2026-85706, an unauthenticated file read it says is already exploited against self-hosted GitLab. Every CE and EE build from 18.7 stays exposed until 19.1.8, 19.2.6 or 19.3.2.
Reality
The fix ships in 19.3.2, 19.2.6 and 19.1.8, and scanning for the flaw started the day after disclosure. Whether you can tell if a read succeeded on your instance depends on whether your proxy logs request bodies.
Perspective Coverage
3 publishersReality
Federal agencies now have three separate patch deadlines inside twelve days. The lowest-scoring pair of the five flaws added to KEV is the one with a documented 24-day intrusion campaign behind it.
Perspective Coverage
13 publishersReality
Black Lotus Labs counted about a dozen compromised enterprises, mostly in Asia and South America, on a framework that has been publishing operator commands to infected hosts through IoT message brokers since 2024.
Perspective Coverage
3 publishersReality
GitLab raised its FY27 revenue guide by $16 million at the midpoint after 24% billings growth, leaving out a Flex shift worth up to $13 million. Fast conversion would leave cash intact and push reported revenue back toward the old range.
Reality
A single September 2026 KEV batch produced 1,262,273 GitLab matches and nothing at all for Cisco Secure Firewall Management Center, because the console holding one of the two 10.0 bugs is the one passive scanning cannot fingerprint.
Reality
The fix for CVE-2026-85706 shipped on 10 September in 19.3.2, 19.2.6 and 19.1.8, and CISA listed the flaw as exploited the next day. A ZoomEye fingerprint count of 1,262,273 hosts does not report versions; it shows where to look.
Reality
Microsoft's Defender Experts date the Contagious Interview campaign to December 2022. Its payload lands at the one hiring stage where a candidate is expected to clone and run a stranger's code. The same team tells employers to give staff a non-persistent VM for coding tests.
Reality
AWS's walkthrough for the pattern wires GitHub and GitLab activity feeds through Step Functions into QuickSight on a schedule you set in CloudFormation, with a detector Lambda that skips the whole cycle when nothing has changed.
Reality
Leadership · September 16, 2026 · 1 publisher
Invest · September 15, 2026 · 1 publisher
Build · September 15, 2026 · 1 publisher
Build · September 14, 2026 · 1 publisher
Build · September 14, 2026 · 1 publisher
Build · September 11, 2026 · 1 publisher
Build · September 10, 2026 · 2 publishers
Product · September 9, 2026 · 1 publisher
Build · September 6, 2026 · 1 publisher
Build · September 1, 2026 · 1 publisher
Build · August 29, 2026 · 1 publisher
Security · August 28, 2026 · 1 publisher
Product · August 27, 2026 · 1 publisher
Build · August 27, 2026 · 1 publisher
Security · August 27, 2026 · 1 publisher
Build · August 23, 2026 · 1 publisher
Build · August 21, 2026 · 1 publisher
Security · August 21, 2026 · 1 publisher
Build · August 21, 2026 · 1 publisher
Security · August 21, 2026 · 1 publisher
Build · August 20, 2026 · 1 publisher
Build · August 18, 2026 · 1 publisher
Product · August 17, 2026 · 1 publisher
Build · August 15, 2026 · 1 publisher