IP Address Leakage Vulnerability in GitLab EE by GitLab
CVE-2026-1516

5.7MEDIUM

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
8 April 2026

What is CVE-2026-1516?

A vulnerability in GitLab EE allows an authenticated user to potentially leak the IP addresses of users accessing Code Quality reports through specially crafted content. This issue affects GitLab versions prior to 18.8.9, 18.9.5, and 18.10.3, underscoring the importance of updating to the latest version to ensure user privacy and system security. Remediation steps are outlined in GitLab's patch release updates.

Affected Version(s)

GitLab 18.0.0 < 18.8.9

GitLab 18.9 < 18.9.5

GitLab 18.10 < 18.10.3

References

https://hackerone.com/reports/3514461
technical-descriptionexploitpermissions-required
https://gitlab.com/gitlab-org/gitlab/-/work_items/587893
https://about.gitlab.com/releases/2026/04/08/patch-releas...

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [maksyche](https://hackerone.com/maksyche) for reporting this vulnerability through our HackerOne bug bounty program
.